Configure PingOne for IP-Based Enforcement

1. Configure the Prisma Browser Application Enforcement. In the PingOne Admin Console, perform the following steps:

   1. Select Connection → Application, select the Prisma Browser application, and click the vertical ellipse.

   2. Click View.

   3. Select the Policy Rules tab and click the pencil icon.
   4. Click Add Policy Rules.
   5. In the Edit Policies window, select Multi_Factor, and click Save.

   6. Select Overview and click PingOne.

      1. Click on the Services + and add the PingOne service.

      2. Click on PingOne and continue the process.

      3. Select the Policy tab and click Add Policy.

   7. In the New Policy page, enter the following information:

      1. In the Name field, enter an identifying name.
      2. In the Application section, select the applications that you want to apply conditional access enforcement.
      3. In the Groups section, select All Groups.

      4. If an application does not appear on the list:

      1. Make sure that the application has multi-factor authentication enabled.
      2. Under PingFederate Applications, click Add Application to add the application to the list.
   8. In the Rules section, click Add Rule.

      1. For Select a Condition, choose Accessing from a company network.

      2. For Action select Approve.
      3. For the IP addresses, manually copy and paste the egress IP addresses as comma-separated-values.
      4. In the Default Action section, choose Deny.
      5. Click Save.
   9. Click the Configuration tab and scroll down to the Policy section.

      1. Enable Enforce Policy.
      2. Enable Policy for Windows Login.
      3. Click Save.

2. Return to IP-Based Enforcement and complete step 3 to select PingOne and turn on enforcement.