Social Login
Table of Contents
Social Login
Configure the Social Login control to manage OAuth-based authentication through social
identity providers on the Prisma Browser.
Set the Social Login Control
| Prisma Browser Desktop | Prisma Browser Extension | Prisma Browser for Mobile |
|---|---|---|
| Full support | Full support | Not available |
The Social Login control allows administrators to manage OAuth-based
authentication through consumer social identity providers. When a user attempts to
log in to a web application using a social login provider, the Prisma Browser
intercepts the OAuth authorization request and enforces the configured policy.
Google and Microsoft are dual-intent providers supporting both social (personal)
and corporate (enterprise) logins. The Social Login control only restricts social
and personal logins. Corporate logins through Google Workspace or Microsoft Entra
ID are not affected by this control.
The control is configured within the Access & Data policy rule wizard under
.
| Provider | OAuth Endpoints Monitored |
|---|---|
| Google OAuth authorization endpoints | |
| Microsoft | Microsoft OAuth and Live authorization endpoints |
| Facebook OAuth dialog | |
| X (formerly Twitter) | X/Twitter OAuth endpoints |
| Github | Github OAuth authorization |
| LinkedIn OAuth authorization | |
| Apple | Apple ID authorization |
To set the Social Login control:
- From Strata Cloud Manager, select .Select a rule and navigate to .Select one of the following options:
![]()
- Allow all - The Prisma Browser allows login with any social login provider.
- Block specific social login providers - Login with the selected social login providers is blocked. Login with other social login providers is allowed.
(Block Specific only) Select the social login providers to block. Select at least one provider from the following:![]()
- Microsoft
- X
- Github
- Apple
(Google only) Configure Google domain exclusions. When Google is selected as a blocked provider, configure the scope of the block:![]()
- All Google accounts blocked - All Google OAuth logins are blocked.
- Exclude specific domains - Enter the domains to allow (for example, acme.com). Users with accounts on excluded domains can still log in with Google — this can be used to allow corporate Google logins while blocking social logins.
Set MFA requirements. Select Require additional MFA prior to login to enforce multi-factor authentication before any social login attempt is allowed.MFA is only available when the effect is set to Allow all. MFA configuration does not apply on the Prisma Browser Extension.Set prompt behavior. When blocking specific providers, select one of the following options:- None - No prompt is displayed.
- Warn and allow to proceed anyway - Inform the user about the restriction and allow the user to continue.
- Warn and allow to proceed anyway with a reason - Inform the user about the restriction. The user must provide a reason to continue.
- Permission request - Allow the user to send a permission request to the administrator.
When a prompt option is selected, configure the bypass time frame. Select how long the bypass remains active after the user proceeds or receives approval.The Prompt option is only available when blocking specific providers.Customize dialog text. Configure the message displayed when a social login is blocked. To set the text, click Set dialog text.Click Set.End User Experience
When the Prisma Browser blocks a social login, the behavior varies by provider:Provider Blocking Behavior Google (no domain exclusions) The OAuth request is cancelled. The user is redirected to the originating page. Google (with domain exclusions) The login flow is restricted to enterprise accounts on allowed domains only. Personal accounts are blocked. Microsoft The login flow is restricted to organizational accounts. Consumer/personal Microsoft accounts are blocked. Apple, Facebook, Github, LinkedIn, X The OAuth request is cancelled. The user is redirected to the originating page. Google Special HandlingWhen Google is blocked with domain exclusions configured, the Prisma Browser restricts the Google login flow to accounts matching the allowed domains. The browser injects parameters that limit account selection to enterprise accounts only. If a user's account does not match an allowed domain, the login is rejected by Google.Microsoft Special HandlingWhen Microsoft is blocked, the Prisma Browser restricts the login flow to organizational accounts by redirecting from consumer authentication paths to the enterprise authentication endpoint. Personal Microsoft accounts (Outlook.com, Hotmail, Xbox Live) are blocked from authenticating.Events
The Prisma Browser generates events when the Social Login control is enforced:Event Trigger Key Fields Login Attempt (Blocked) A social login attempt matches a blocking policy Rule ID, URL, login method (Social), identity provider URL, policy action Login Attempt (Bypassed) A user bypasses a blocked login via prompt Rule ID, URL, login method, bypass reason Events are not generated when the policy action is "Allow".Limitations
- Mobile platform is not supported.
- MFA is only available when the effect is set to "Allow all".
- The Prompt option is only available when blocking specific providers (not when set to "Allow all").
