>
    Strata Copilot
    Onboard a Celonis App to SSPM
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. Onboard SaaS Apps Supported by SSPM
    4. Onboard a Celonis App to SSPM
    Download PDF
    SaaS Security

    Onboard a Celonis App to SSPM

    Table of Contents

    Onboard a Celonis App to SSPM

    Connect a Celonis instance to SSPM to detect posture risks.
    Where Can I Use This?What Do I Need?
    • Strata Cloud Manager
    • SaaS Security Posture Management license
    Or any of the following licenses that include the Data Security license:
    • CASB-X
    • CASB-PA
    For SSPM to detect posture risks in your Celonis instance, you must onboard your Celonis instance to SSPM. Through the onboarding process, SSPM connects to a Celonis API and, through the API, scans your Celonis instance for misconfigured settings. If there are misconfigured settings, SSPM suggests a remediation action based on best practices.
    SSPM gets access to your Celonis instance through an API access key. During the onboarding process, SSPM prompts you for the API access key and related information about your Celonis instance.
    To onboard your Celonis instance, you complete the following actions:

    Collect Information for Accessing Your Celonis Instance

    To access your Celonis instance, SSPM requires the following information, which you will specify during the onboarding process.
    ItemDescription
    Team API KeyA generated character string that identifies a Celonis administrator to the Celonis API. SSPM requires this API key to authenticate to the API.
    Required permissions: The API key must be generated by a user with admin access to your Celonis team.
    Team domain
    The URL for your Celonis team.
    As you complete the following steps, make note of the values of the items described in the preceding table. You will need to enter these values during onboarding to access your Celonis instance from SSPM.
    1. Identify your team domain URL.
      The URL for your team domain appears in the address bar of your browser and has the format https:// <team-domain>. <region>.celonis.cloud. If you are not certain of your team domain URL, you can query Celonis for a list of all of your teams. This list includes the team URLs. To query Celonis for your team domain URL, open a web browser to https://celonis.cloud/find-my-team.
      Before you continue to the next step, make note of your team domain URL. You will provide this information to SSPM during the onboarding process.
    2. Generate an API key for your team domain.
      1. Log in to your Celonis team domain as an administrator. The API key will inherit the access permissions of the administrator account that generates the key. Because the API key will inherit the account permissions, the account must have Admin access to your team domain.
      2. Select Profile menuEdit Profile.
      3. On the Edit Profile page, locate the API-Keys section. Enter a New API Key Name and Create API Key.
        Celonis generates and displays a new API key.
      4. Click Copy To Clipboard and paste the key into a text file.
      Do not continue to the next step unless you have copied the API Key. You must provide this key to SSPM during the onboarding process.

    Connect SSPM to Your Celonis Instance

    By adding a Celonis app in SSPM, you enable SSPM to connect to your Celonis instance.
    1. Log in to Strata Cloud Manager.
    2. Select ConfigurationSaaS SecurityPosture SecurityApplicationsAdd Application and click the Celonis tile.
    3. Under posture security instances, Add Instance or, if there is already an instance configured, Add New instance.
    4. Enter the team API key and team domain, and Connect.

    © 2026 Palo Alto Networks, Inc. All rights reserved.