>
    Strata Copilot
    SaaS Visibility and Controls
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. Get Started with SaaS Security Inline
    4. SaaS Visibility and Controls
    Download PDF
    SaaS Security

    SaaS Visibility and Controls

    Table of Contents

    SaaS Visibility and Controls

    Use this workflow to onboard SaaS Security Inline.
    Where Can I Use This?What Do I Need?
    Data Security, SaaS Security Posture Management, and Behavior Threats:
    • Strata Cloud Manager
    SaaS Security Inline:
    • NGFW (Managed by Panorama or Strata Cloud Manager)
    • Prisma Access (Managed by Panorama or Strata Cloud Manager)
    One of the following SaaS Security licenses:
    • Data Security license, and a NGFW or Prisma Access license
    • SaaS Security Inline license
    • SaaS Security Posture Management license
    Or any of the following licenses that include one of the SaaS Security licenses:
    • CASB-X
    • CASB-PA
    SaaS Security Inline provides SaaS visibility so that you can identify cloud‑based threats and risky user activity on sanctioned and unsanctioned SaaS apps.
    Getting started is quite simple. If your Strata Logging Service is configured to receive logs from your Palo Alto Networks firewalls, after activation, SaaS Security Inline automatically discovers all SaaS apps and users and analyzes users’ SaaS activity and usage data and presents risk analytics. After you evaluate the data in the Dashboard, you’re ready to tag SaaS apps, configure risk scores, and generate reports to better understand and respond to SaaS app usage of sanctioned and unsanctioned SaaS apps.
    Use the following workflow if you want to use SaaS visibility only. If you want to use all the features of SaaS Security Inline, including SaaS visibility, ACE, and policy rule recommendations to protect against cloud‑based threats, use the SaaS Visibility and Controls for NGFWworkflow instead.
    • Activate SaaS Security Inline for NGFW, VM-Series, or Prisma Access.
    • Request that your firewall administrator forward logs to Strata Logging Service so that SaaS Security Inline discovers all SaaS apps and users, if you haven’t already.
    • Add administrators to analyze SaaS visibility data.
    SaaS Security Inline on Prisma Access—Managed by Panorama or Strata Cloud Manager, SaaS Security Inline provides SaaS visibility so that you can identify cloud‑based threats and risky user activity on sanctioned and unsanctioned SaaS apps.
    Getting started is quite simple. After activation, SaaS Security Inline automatically discovers all SaaS apps and users and analyzes users’ SaaS activity and usage data and presents risk analytics. After you evaluate the data in the Dashboard, you’re ready to tag SaaS apps, configure risk scores, and generate usage, risk, and compliance reports to audit, understand, and respond to SaaS app usage of sanctioned and unsanctioned SaaS apps.
    Use the following workflow if you want to use SaaS visibility only. If you want to use all the features of SaaS Security Inline, including SaaS visibility, ACE, and SaaS policy rule recommendations to protect against cloud‑based threats, use the SaaS Visibility and Controls workflow instead.

    SaaS Visibility and Controls for NGFW

    Use this workflow to onboard both SaaS visibility and policy enforcement on SaaS Security Inline on NGFW.
    With PAN-OS 10.1 or later, SaaS Security Inline protects against cloud‑based threats by blocking traffic for unsanctioned SaaS apps and risky user activity using Security policy. Use the following workflow if you want to use all the features of SaaS Security Inline, including App-ID Cloud Engine (ACE), SaaS policy rule recommendations, and SaaS visibility.
    Step 1: Activation
    Because SaaS Security Inline is tightly integrated with your NGFW, you and your NGFW administrator will perform a few handoffs throughout the activation process.
    • Learn about ACE and SaaS Security Inline. (SaaS administrator and NGFW administrator)
    • Start the ACE deployment on your unmanaged NGFW or use a Panorama® management server to deploy ACE on NGFW (Managed by Panorama). (NGFW administrator)
    • Activate SaaS Security Inline to push the SaaS Security Inline license to your NGFW. (SaaS administrator)
    • Complete the ACE deployment on your NGFW. (NGFW administrator)
    Step 2: System Configuration
    • Integrate with Azure Active Directory so that SaaS Security Inline can identify your AD groups. (SaaS administrator)
    • Add administrators to manage Security policy. (SaaS administrator)
    Step 3: Security Policy Configuration
    • Review the guidelines for effective collaboration and rulebase management. (SaaS administrator and NGFW administrator)
    • Verify log forwarding on all firewalls. (NGFW administrator)
      As part of your ACE deployment, you enabled log forwarding. SaaS Security Inline cannot display SaaS app visibility data and might not be able to enforce policy rule recommendations without logs for all NGFW.
    • Author and submit SaaS policy rule recommendations to your NGFW administrator, after adhering to prerequisites. (SaaS administrator)
    • Import new SaaS policy rule recommendations. (NGFW administrator)
    Step 4: Security Policy Maintenance
    • Continuously monitor the SaaS policy rule recommendations to ensure they’re in sync. (SaaS administrator)
    • Continuously monitor the SaaS policy rule recommendations for changes. (NGFW administrator)
      • For updates, reimport changes to active SaaS policy rule recommendations.
      • For deletions, remove recommendation mapping, then delete the policy rule.
    • Use Policy Optimizer to determine when and how many times traffic matches the Security policy rule to determine its effectiveness. (NGFW administrator)

    SaaS Visibility and Controls for Prisma Access (Managed by Panorama)

    Use this workflow to onboard both SaaS visibility and policy enforcement on SaaS Security Inline on Prisma Access (Managed by Panorama).
    SaaS Security Inline protects against cloud‑based threats by blocking traffic for unsanctioned SaaS apps and risky user activity using Security policy. Use the following workflow if you want to use all the features of SaaS Security Inline, including App-ID Cloud Engine (ACE), SaaS policy rule recommendations, and SaaS visibility.
    Step 1: Activation
    • Learn about ACE and SaaS Security Inline. (SaaS administrator and Prisma Access administrator)
      ACE is enabled by default on Prisma Access (Managed by Panorama).
    • Perform the prerequisites outlined in Prisma Access Administrator’s Guide, including log forwarding. Without data logs, SaaS Security Inline cannot display SaaS app visibility data and might not be able to enforce policy rule recommendations.
    • Activate the SaaS Security Inline license. (SaaS administrator)
    Step 2: System Configuration
    • Integrate with Azure Active Directory so that SaaS Security Inline can identify your AD groups. (SaaS administrator)
    • Add administrators to manage SaaS Security. (SaaS administrator)
    Step 3: Security Policy Configuration
    • Review the guidelines for effective collaboration and rulebase management. (SaaS administrator and Prisma Access administrator)
    • Author and submit SaaS policy rule recommendations to your Prisma Access administrator. (SaaS administrator)
    • Import new SaaS policy rule recommendations. (Prisma Access administrator)
    Step 4: Security Policy Maintenance
    • Continuously monitor the SaaS policy rule recommendations to ensure they’re in sync. (SaaS administrator)
    • Continuously monitor the SaaS policy rule recommendations for changes. (Prisma Access administrator)
      • For updates, reimport changes to active SaaS policy rule recommendations.
      • For deletions, remove recommendation mapping, then delete the policy rule.

    SaaS Visibility and Controls for Prisma Access (Managed by Strata Cloud Manager)

    Use this workflow to onboard both SaaS visibility and policy enforcement on SaaS Security Inline on Prisma Access (Managed by Strata Cloud Manager).
    SaaS Security Inline protects against cloud‑based threats by blocking traffic for unsanctioned SaaS apps and risky user activity using Security policy. Use the following workflow if you want to use all the features of SaaS Security Inline, including App-ID Cloud Engine (ACE), SaaS policy rule recommendations, and SaaS visibility.
    Step 1: Activation
    • Learn about SaaS Security Inline. (All administrators)
    • Learn about the Hub roles that enable administrators to collaborate on SaaS Security. (All administrators)
    • Learn about ACE. (Web Security administrator)
      With a SaaS Security Inline license, ACE is enabled by default on Prisma Access (Managed by Strata Cloud Manager).
    • Activate SaaS Security Inline on the Hub. (SaaS administrator)
    Step 2: SaaS Security Configuration
    • Enable Web Security. (Web Security administrator)
    • Integrate with Azure Active Directory so that SaaS Security Inline can identify your AD groups. (SaaS administrator)
    • Add administrators to manage SaaS Security. (Security administrator)
    Step 3: Policy Rule Recommendation Enforcement
    • Review the guidelines for effective collaboration and rulebase management. (All administrators)
    • Author and submit SaaS policy rule recommendations to your Prisma Access administrator, after adhering to prerequisites. (SaaS administrator and Data Security administrator)
    • Import and push new SaaS rule recommendations. (Web Security administrator)
    • Push new SaaS rule recommendations. (Security administrator)
    Step 4: Policy Rule Recommendation Management
    • Continuously monitor the SaaS policy rule recommendations to ensure they’re in sync. (All administrators)
    • Enable automatic updates and monitor the SaaS policy rule recommendations for changes. (Web Security administrator)
      • For updates, reimport changes to active SaaS policy rule recommendations.
      • For deletions, remove recommendation mapping, then delete the policy rule.
    • Use Policy Optimizer on Prisma Access (Managed by Strata Cloud Manager) or Policy Optimizeron NGFW or Prisma Access (Managed by Strata Cloud Manager) to determine when and how many times traffic matches the Security policy rule to determine its effectiveness. (Security administrator)

    © 2026 Palo Alto Networks, Inc. All rights reserved.