Use Prisma Agent Pre-Logon

Table of Contents

Use Prisma Agent Pre-Logon

Pre-logon keeps your device securely connected to your work network, even before you log in. It provides access for maintenance and transitions to full network access when you log in.

Where Can I Use This?	What Do I Need?
Prisma Agent	Minimum Prisma Agent version: 25.3 (macOS and Windows) macOS 14 and later or Windows 10 version 2024 and later desktop devices Internet access

The pre-logon feature for Prisma Agent offers a seamless and secure connection experience throughout your device's operation cycle. When your device starts up, the pre-logon mode automatically initializes and establishes a secure connection using your device's machine certificate. This occurs before you reach the operating system login screen, ensuring immediate network connectivity. On Windows machines, you will see a tile at the login screen displaying the pre-logon tunnel status as Internal, Connected, or Disconnected, providing clear visibility of your network status.

As you log in with your credentials, the pre-logon tunnel smoothly transitions to your full user session. The Prisma Agent reauthenticates, granting broader access rights based on your user profile. You don't need to manually establish a connection—it's already set up for you. During your session, you have full access to network resources as defined by your organization's policy rules, with the connection remaining active to ensure consistent and secure access.

When you log out, your user-specific session ends, but the system automatically re-establishes the pre-logon connection. This ensures your device maintains essential network connectivity for system tasks even when you're not logged in. Each subsequent login follows the same pattern, providing a consistent experience of transitioning from pre-logon to full user access. This pre-logon feature enhances your productivity by ensuring immediate and secure network access, simplifying the login process, and maintaining essential connectivity at all times.

Before you can use pre-logon, your administrator must have configured pre-logon support for the Prisma Agent.

The Windows pre-logon process is different from the pre-logon for macOS. When your device starts up, the pre-logon process on Windows will show you what happens during a pre-logon connection. While on macOS, there are no visual cues related to the pre-logon connection. You just need to sign in when prompted by the operating system.

To use pre-logon on a Windows device:

If your device has never been enrolled, meaning that the Prisma Agent has never registered with the server, and never been configured on your device, do the following when your device starts up.
1. The pre-logon enrollment proceeds automatically.
2. Wait for the enrollment process to finish. This will register your device with the server and download the necessary configurations for the Prisma Agent to your device.
3. At this point, the Prisma Agent will automatically authenticate and connect to the best available gateway.
4. When the agent has connected to the gateway, enter your system password and press Enter.
5. After you log in successfully, the pre-logon connection transitions to a full user session with potentially broader access rights, where you can access the resources in your network based on your organization's security policy rules.
6. When you log out of the operating system, your user-specific session ends, but the system automatically re-establishes the pre-logon connection.
If your device has previously been enrolled and you're just starting it up:
1. The Prisma Agent will automatically authenticate and connect to the best available gateway as shown in the following image:
2. When the agent has connected to the gateway, enter your system password and press Enter.
3. After you log in successfully, the pre-logon connection transitions to a full user session with potentially broader access rights, where you can access the resources in your network based on your organization's security policy rules.
4. When you log out of the operating system, your user-specific session ends, but the system automatically re-establishes the pre-logon connection.