>
    Strata Copilot
    Create SSPM Policies to Monitor SaaS App Settings
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. Assess Posture Security
    4. Create SSPM Policies to Monitor SaaS App Settings
    Download PDF
    SaaS Security

    Create SSPM Policies to Monitor SaaS App Settings

    Table of Contents

    Create SSPM Policies to Monitor SaaS App Settings

    Create SaaS Security Posture Management policies to identify a group of app settings for SSPM to monitor.
    Where Can I Use This?What Do I Need?
    • Strata Cloud Manager
    • SaaS Security Posture Management license
    Or any of the following licenses that include the Data Security license:
    • CASB-X
    • CASB-PA
    SaaS Security Posture Management scans your SaaS apps for misconfigured settings at regular intervals. Each setting is associated with one of SSPM's built-in rules. When SSPM detects a misconfigured setting, SSPM alerts you by setting the rule's status to Failed in the Security Configurations view. A daily digest email that SSPM sends to the app owner also includes information about failed rules.
    In addition to SSPM's built-in rules, you can create policies to monitor app settings. In an Application Settings Policy, you identify the specific settings for specific app instances for SSPM to monitor. If SSPM detects that any of the settings are misconfigured, SSPM notifies you and sets the policy's status to Failed in the Security Configurations view.
    In addition to creating these polices to monitor SaaS app settings, you can create Plugin Access Control policies to detect when users install third-party plugins that you don’t want to allow in your environment.
    1. Log in to Strata Cloud Manager.
    2. Select ConfigurationSaaS SecurityPosture SecuritySecurity ConfigurationsPolicies.
    3. Add Policy Application Settings Policy.
      A Policy Creation page for an app settings policy opens.
    4. On the Basic Information tab, specify the following information about your policy:
      • The Name of the policy. This name will appear in the list of policies on the Policies tab of the Settings Management page. For this reason, specify a meaningful name that will be distinguishable from the other policies in the list.
      • A Description of the policy. After you create the policy, this description will appear on the details page for the policy. Describe the purpose of the policy for administrators who might be viewing the policy later.
      • The Severity of the policy, so administrators will know how seriously they should treat violations of the policy. You can specify one of the following severity levels, which will be shown for the policy on the Policies tab of the Settings Management page.
        • High — Means that violations of this policy indicate a significant vulnerability in your security posture. Specify this severity level if the misconfigured settings that SSPM detects for this policy have the potential to be exploited and result in significant damage if left unaddressed.
        • Medium — Means that violations of this policy will indicate issues that pose a potential security risk, but are less severe than the High severity level. Remediation of these issues should be prioritized, but they may not require immediate attention.
        • Low — Means that violations of this policy will have a minimal impact on security or are relatively low-risk. Specify this severity level to indicate that, while the misconfigured settings might not pose an immediate threat, they should still be addressed to maintain a healthy security posture.
    5. Go to the Next tab of the Policy Creation page to configure the policy.
    6. On the Config Selection tab, select the apps and settings that SPPM will monitor for this policy.
      1. Locate the settings that you want SSPM to monitor for this policy. To help you locate the settings that you want to monitor, you can filter the table list by app or by the current setting status.
      2. To select a setting, set its Alert toggle to the on position.
      3. When you have finished selecting all the settings that you want SSPM to monitor for this policy, go to the Next tab of the Policy Creation page to verify the policy configuration.
    7. Go to the Next tab of the Policy Creation page to configure the policy actions.
    8. On the Policy Actions tab, select one or more actions.
      These are the actions that you want SSPM to take when it detects that a monitored setting has become misconfigured. You specify an action for each setting that SSPM is monitoring for the policy. The following actions are available:
      • Ticket: If you are using the Jira or ServiceNow issue tracking system to manage your team's tasks, SSPM can create a tickets in the issue tracking system about the misconfigured setting that SSPM detected for the policy. To configure SSPM for ticket creation, you must have linked SSPM to a Jira or ServiceNow instance. From the Configure Ticketing area, you can select the issue tracking system and specify information such as the type and instance of the issue tracking system, and the type of ticket to create.
      • Notify: SSPM can send information about the misconfigured setting that SSPM detected for the policy to an email address. If you have configured webhooks in SSPM to send notifications to a channel in Slack or Microsoft Teams, SSPM can also send notifications to one of those webhooks. SSPM sends the email notifications to the email address of the user who created the plugin access control policy. SSPM sends webhook notifications to the webhook you select in the Configure Notification area.
    9. Review the information on the Summary tab to verify that the information is correct. If necessary, you can Edit the information. When you're sure that this is the policy that you want to create, Save the policy.

    © 2026 Palo Alto Networks, Inc. All rights reserved.