In enterprise environments, some Windows devices are shared by multiple employees who log in sequentially throughout the day. Common examples include hospital bedside stations, bank teller kiosks, and branch office PCs. Prisma® Agent provides per-user session isolation for these shared workstations: when a user switch occurs, the agent signs out the departing user, clears their cached credentials, and waits for the incoming user to authenticate before establishing a new secure session.

No configuration is required to enable shared workstation detection. The Endpoint Manager automatically identifies shared workstations in the background. A device used by two or more unique users within 30 days is automatically classified as a shared workstation. You can verify this classification in the agent inventory in Endpoint Management, which includes a Shared Workstation column and a per-device login history for the past 30 days.

Session isolation applies to both fast user switching and full logout-and-login sequences. Authentication behavior depends on who logs in next. If the same user returns, the agent reconnects the session without prompting for credentials. If a different user logs in, authentication depends on the deployment configuration of that user. Certificate-based authentication reconnects automatically if the user has a single certificate installed; if the user has multiple certificates, they must select the relevant one. For LDAP, the user must enter credentials in the Prisma Agent sign-in window. SAML opens a browser sign-in prompt for the incoming user.

Shared workstation session isolation is available on Windows devices, including physical shared workstations and remote desktops accessed through Remote Desktop Protocol (RDP). Multi-session environments, such as Azure Virtual Desktop multi-session, are not supported; use the Terminal Services Agent for those deployments.

In this release, Endpoint Manager–pushed configurations reset when a user switches.