>
    Strata Copilot
    Configure Idira for IP-Based Enforcement
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. First-Party Integrations
    4. Enforcing the Browser
    5. IP-Based Enforcement
    6. Configure Idira for IP-Based Enforcement
    Download PDF
    Prisma Browser

    Configure Idira for IP-Based Enforcement

    Table of Contents

    Configure Idira for IP-Based Enforcement

    Allow sign-in to Idira only from the Prisma Browser.
    Where Can I Use This?What Do I Need?
    • Strata Cloud Manager
    • Standalone Prisma Browser
    • Prisma Access with Prisma Browser bundle license or Prisma Browser standalone license
    • Role: Prisma Browser Roles
    • Administrator access to the Idira Admin Portal
    Follow these steps to limit access to all or specific applications to the Prisma Browser when you use Idira as the identity provider.
    Idira checks the source IP address of each sign-in request. You add the tenant IP addresses of the Prisma Browser to an Idira secure zone, and then require that zone in the authentication rule of each application. Idira denies sign-in attempts from any other IP address, including attempts from other browsers.
    Before you begin, create your tenant IP addresses in step 1 of IP-Based Enforcement. Copy the list of IP addresses. You use them in step 1 below.
    1. Define a secure zone for the Prisma Browser IP addresses.
      1. In the Idira Admin Portal, go to SetupSecurityNetwork restrictionsSecure zones.
      2. Click AddAdd IP range.
      3. Configure the following:
        • Name - Enter a descriptive name. For example, Prisma Browser IPs.
        • IP range or address - Enter the Prisma Browser egress IP addresses, separated by commas. For example: 203.0.113.10/32, 203.0.113.11/32, 203.0.113.12/32.
      4. Click Add.
    2. Require the secure zone in the authentication policy of the application.
      1. Go to ManageInventoryApplications, and select the web application to restrict.
      2. In the application settings, select Policy.
      3. Under Authentication Policy, select Use Authentication Rules.
      4. Click Add Rule, and then click Add Filter.
      5. Configure the condition:
        • Filter - Select IP Address.
        • Condition - Select inside secure zone.
        • Value - Select the secure zone that you created in step 1.
      6. Click Add.
      7. For Authentication Profile (if all conditions met), select - Always Allowed -, and then click OK.
      8. For Default profile (applied if no conditions matched), select - Not Allowed -.
        The default profile is Always Allowed unless you change it. If you skip this step, users can still sign in from other browsers and networks.
      9. Click Save.
      10. Repeat this step for each application that must be accessible only from the Prisma Browser.
    3. Return to IP-Based Enforcement and complete step 3 to select Idira and turn on enforcement.

    © 2026 Palo Alto Networks, Inc. All rights reserved.