Configure Workspace ONE for IP-Based Enforcement

Table of Contents

Configure PingOne for IP-Based Enforcement

Conditional Access Using the Device Posture IdP

Configure Workspace ONE for IP-Based Enforcement

Allow sign-in to Workspace ONE only from the Prisma Browser.

Where Can I Use This?	What Do I Need?
Strata Cloud Manager Standalone Prisma Browser	Prisma Access with Prisma Browser bundle license or Prisma Browser standalone license Role: Prisma Browser Roles

IP-based enforcement allows sign-in to your applications only from the Prisma Browser. Workspace ONE checks the source IP address of each sign-in request and allows it only when it comes from your tenant IP addresses. A sign-in from any other browser is blocked.

Follow these steps to limit access to all or specific apps to the Prisma Browser when you use VMware Workspace ONE.

Before you begin, create your tenant IP addresses in step 1 of IP-Based Enforcement.

Configure the Prisma Browser Application Enforcement. In the Main Access Portal page, perform the following steps:
1. On the main Access Portal page, select Resources -> Policies, and click Network Ranges.
2. Click Add Network Range.
3. Enter a Name and Description for the Network Range.
4. manualle enter each row of the egress IP addresses.
  
  The values must be entered as "from -to" without including the subnet mask.
5. Click Save. The new Network Range will be added to the list.
Select Applications and User Group to Adhere to Policy
1. On the main Access Portal page, select Resources -> Policies, and click Add Policy.
2. On the Definition page, enter a name and a description for the Policy.
3. Select the relevant application in the Applies to field.
  
  The Prisma Browser cannot be a required application for enforcement.
4. Click Next.
5. On the Configuration page, click Add Policy Rule, and provide the following information:
  If a user's network range is - Select the Range Name defined in the previous step.If a user's network range is – Select the Range Name defined in the previous step.
  and the user accessing content from – All Device Types.
  and the user belongs to a group – Select the affected group (optional).
  Then perform this action – Authenticate using…
  then the user may authenticate using – Password (Local Directory)
6. Click Save. The new policy will be displayed,
7. Click Next and review the New Access Policy Summary.
8. Click Save. The new policy will be added to the policy list.
Return to IP-Based Enforcement and complete step 3 to select Workspace ONE and turn on enforcement.