Deploy Prisma Agents to Windows Endpoints Using Microsoft Intune

Table of Contents

Deploy Prisma Agents Using Microsoft Intune

Deploy Prisma Agents to macOS Endpoints Using Microsoft Intune

Deploy Prisma Agents to Windows Endpoints Using Microsoft Intune

Learn how to deploy Prisma Agents to your Windows endpoints using Microsoft Intune. You can also learn how to uninstall Prisma Agents.

Where Can I Use This?	What Do I Need?
Prisma Access (Managed by Strata Cloud Manager) Prisma Access (Managed by Panorama) NGFW (Managed by Panorama)	Check the prerequisites for the deployment you're using Prisma Agent version: 25.3.1.14 Windows 10 version 2024 and later desktop devices Contact your Palo Alto Networks account representative to activate the Prisma Agent feature

Use Microsoft Intune to deploy and install the Prisma Agent on managed Windows devices in your organization. Two installer variants are available:

PrismaAccessAgent_x64_<version>.msi—Installer that includes Endpoint DLP. Endpoint DLP deploys as part of the Prisma Agent package—no additional configuration is required. A separate Endpoint DLP license is required. This variant can only be deployed via MDM—it cannot be run manually by end users.
PrismaAccessAgent_NoDLP_x64_<version>.msi—Standard installer without Endpoint DLP.

The Endpoint DLP agent requires a separate license and remains inactive until you activate the license.

If you need to uninstall Prisma Agent for specific user groups, you can create a script for uninstalling the Prisma Agent that Intune can deploy to the specific user groups.

To deploy the Prisma Agent for Windows using Intune:

Push the required GoDaddy CA certificates to your Windows endpoints using trusted certificate profiles in Microsoft Intune before deploying the Prisma Agent.
Windows endpoints in environments where automatic root certificate updates are blocked — such as private networks without internet access, endpoints with the Turn off Automatic Root Certificates Update GPO enabled, or endpoints pointing to an internal WSUS server — may be missing the Go Daddy Root Certificate Authority - G2 certificate. If this certificate is not in the endpoint's trusted root store, the Prisma Agent fails to enroll with the Endpoint Manager. See CA Certificate Requirements for Endpoint Manager Enrollment for details.
1. In the Microsoft Intune admin center, select DevicesConfiguration and create a new profile.
2. Choose Windows 10 and later as the platform and Trusted certificate as the profile type.
3. Upload the Go Daddy Root Certificate Authority - G2 certificate file and set Destination store to Computer certificate store – Root.
4. Repeat for the Go Daddy Secure Certificate Authority - G2 intermediate certificate, setting Destination store to Computer certificate store – Intermediate.
5. Assign both profiles to the device groups targeted for Prisma Agent deployment and confirm that they report a Succeeded status before proceeding.
Download the Windows Prisma Agent package and configuration file (config.json) from ConfigurationEndpoint Management in Strata Cloud Manager.
The download dialog shows all available packages. Choose the Windows installer based on whether your organization uses Endpoint DLP:
- With Endpoint DLP: Download the Win package (PrismaAccessAgentInstaller_<version>.pkg) from the Endpoint DLP Packages section of the Download Prisma Access Agent dialog. This package bundles Prisma Agent with Endpoint DLP. Endpoint DLP requires a separate license and can only be deployed via MDM.
- Without Endpoint DLP: Download the standard Prisma Agent Win package (PrismaAccessAgentInstaller_NoDLP_<version>.pkg). This package contains only the Prisma Agent installer.
Open the config.json file in a text editor and make sure that it contains the correct server URL and Prisma Access tenant ID.
The config.json file should have at minimum the following elements:
```
{
    "server_url":"xxx.epm.gpcloudservice.com",
    "tenant_id":"xxxxxxxxxx"
}
```
You can add other predeployment options in the config.json file such as enabling pre-logon support and disabling the GlobalProtect app (if installed on the endpoint) during the installation of the Prisma Agent. For example:
```
{
     "server_url":"xxx.epm.gpcloudservice.com",
     "tenant_id":"xxxxxxxxxx",
     "pre_logon_supported": true,
     "unload_gp": true
}
```
Create an .intunewin packager that includes the Prisma Agent installer and configuration file.
1. Create a source folder on your Windows machine and copy and paste the installer package and configuration file (config.json) to this folder.
  The installer package filename depends on whether your organization uses Endpoint DLP:
  
  With Endpoint DLP: PrismaAccessAgent_x64_xx.x.xxxxx.xxxx.msi
  Without Endpoint DLP: PrismaAccessAgent_NoDLP_x64_xx.x.xxxxx.xxxx.msi
  
  For example, create a folder called PAA_in and put the Prisma Agent installer and config.json file in this folder.
2. Create a PowerShell wrapper script in this source folder that tells Microsoft Intune how to install the Prisma Agent. The script must contain the name of the Prisma Agent installer file.
  For example, create a PowerShell script called paa.ps1 that includes the following statements. Update the $MSIFileName value to match the installer you downloaded—use the PrismaAccessAgent_x64_xx.x.xxxxx.xxxx.msi filename if your organization uses Endpoint DLP, or PrismaAccessAgent_NoDLP_x64_xx.x.xxxxx.xxxx.msi if it does not:
  
  $MSIFileName = 'PrismaAccessAgent_x64_xx.x.xxxxx.xxxx.msi' $MSISwitches = '/quiet /norestart' $ScriptPath = Split-Path -Path $MyInvocation.MyCommand.Path $InstallProcess = Start-Process -FilePath "msiexec" -ArgumentList ("/i " + [char]34 + $ScriptPath + "\" + $MSIFileName + [char]34 + " " + $MSISwitches) -PassThru -Wait Write-Host ("Installation completed, exiting with last return code (" + $InstallProcess.ExitCode + ")") Exit $InstallProcess.ExitCode
3. Create a batch file in this source folder to invoke the wrapper script. For example, create a batch file called InstallPAA.cmd that includes the following statements:
  @ECHO OFF @SystemRoot@\SysNative\WindowsPowershell\v1.0\powershell.exe -ExecutionPolicy Bypass .\paa.ps1 EXIT /B %ERRORLEVEL%
4. Ensure that your source folder contains all the necessary files. For example:
5. Use the Microsoft Win32 Content Prep Tool to create the intunewin packager.
  Download the Win32 Content Prep Tool (IntuneWinAppUtil.exe).
  Run the IntuneWinAppUtil.exe app on Windows.
  When prompted, specify the following:
  Source folder—Enter the name of the source folder that you created. For example, enter C:\<your_path>\PAA_in.
  Setup file—Enter the name of the Prisma Agent installer (PrismaAccessAgent_x64_xx.x.xxxxx.xxxx.msi).
  Output folder—Enter the name of the folder where the .intunewin file will go. For example, enter C:\<your_path>\PAA_out.
  Catalog folder—Enter N.
  
  The Microsoft Win32 Content Prep Tool will create the PrismaAccessAgent_x64_xx.x.xxxxx.xxxx.intune file in the output folder you specified.
Create a custom Win32-based app using the intunewin packager that you created in the previous step.
1. Log in to the Microsoft Intune admin center from your web browser.
2. Select AppsWindowsAdd.
3. Select the Windows app (Win32) app type and click Select.
4. Click Next.
5. In App information, upload the app package file (.intunewin) that you created.
  In App package file, select PrismaAccessAgent_x64_xx.x.xxxxx.xxxx.intune and click OK.
  
  Enter basic information for the app:
  Give the app a Name, such as PAA or PAA-DLP.
  Enter a Description, such as Prisma Access Agent.
  For Publisher, enter PANW.
  
  Click Next.
6. For the Install command in the Program tab, enter the name of the batch file (.cmd) that you created. For example, enter InstallPAA.cmd and click Next.
7. In Requirements, select 64-bit for the operating system architecture and select Windows 10 1607 as the minimum operating system. Click Next.
8. In Detection rules, select Manually configure detention rules and specify the following values:
  Rule type—Registry
  Key path—HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\Prisma Access Agent
  Value name—ProductCode
  Detection method—String comparison
  Operator—Equals
  Value—{919D7686-A2F1-4199-9A8F-43CB0541AA26}
  
  This value will change based on the Prisma Agent version you're deploying.
  
  Associated with a 32-bit app on 64-bit clients—No
  
  Click OK and Next.
9. In Dependencies, click Next.
10. In Supersedence, click Next.
11. In Assignments, specify the user groups that will use the app.
  Click Add group and select the groups that you wan to deploy the app to.
  
  Click Select and Next.
12. In Review + create, review your settings for the app, and Create the app in Intune.
  
  The Prisma Agent will be deployed to the user groups that you assigned.
13. To view the app installation status from Intune, select AppsAll Apps and select the Prisma Agent app that you added. You can get an overview of the app status and the Device install status and User install status.

Uninstall the Prisma Agent on Windows Endpoints Using Microsoft Intune

You can create a script for uninstalling the Prisma Agent from Windows endpoints and then upload the script to Microsoft Intune. You can assign the uninstall script to specific user groups, which uninstalls the Prisma Agent on their devices.

Before you begin, you will need the anti-tamper unlock (supervisor) password that you set up in the general global Prisma Agent settings.

Endpoint DLP is automatically uninstalled along with the Prisma Agent.

Create a PowerShell script that uninstalls the Prisma Agent.

The following sample script is provided as a reference. Customize the script as needed for your environment:

# Uninstall_PAA.ps1

# Check if running as Administrator
$currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
$isAdmin = $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $isAdmin) {
    Write-Host "Script is not running as administrator."
	Exit -1
}

# Disable the anti tampering. For now the password needs to be echoed
Write-Host ("Disabling the anti-tampering")
$password = "example_supervisor_password"
echo $password | & 'C:\Program Files\Palo Alto Networks\Prisma Access Agent\PACli.exe'  protect disable /run /exit /SlientMode

# Retrieving the Prisma Access Agent product code
Write-Host ("Retrieving the Prisma Access Agent product code")
$prodCode = Get-ItemPropertyValue 'HKLM:\SOFTWARE\Palo Alto Networks\Prisma Access Agent' 'ProductCode'
Write-Host ("Prisma Access Agent product code: " + $prodCode) 

# Uninstall the agent using Msiexec.exe
Write-Host ("Executing the uninstaller")
$UnInstallProcess = Start-Process -FilePath "${env:SystemRoot}\System32\msiexec" -ArgumentList ("/x " + $prodCode + " /quiet /norestart") -PassThru -Wait

Write-Host ("UnInstallation completed, exiting with last return code (" + $UnInstallProcess.ExitCode + ")")
Exit $UnInstallProcess.ExitCode

Upload and assign the script to specific user groups in Intune.
1. Log in to the Microsoft Intune admin center from your web browser.
2. Select DevicesScripts and remediationsPlatform scripts.
3. Add a Windows 10 and later script.
4. Enter a Name for the script.
5. In the Script location, select the uninstall script that you created.
6. In Assignments, specify the user groups that will receive the uninstall script.
7. In Review + add, review the settings for the script, and Add the script to Intune.
  
  The Prisma Agent will be uninstalled from the devices in the user groups that you assigned.