Create identity-based security rules that apply different DNS security profiles
to user groups connecting through the Advanced DNS Security Resolver.
| Where Can I Use
This? | What Do I Need? |
|---|
By default, all users connecting through a given connection source share the same DNS
security profile. User group security policies let you override this default by
applying different DNS security profiles to specific user groups based on their
identity. This allows you to enforce stricter protection for high-risk groups — such
as contractors, temporary employees, or users in sensitive departments — while
maintaining standard policies for the rest of the organization.
User group security policies use identity information from
Cloud Identity Engine (CIE) to determine
group membership. CIE syncs user and group information from your identity providers
(such as Active Directory, Okta, or Azure AD) so they can
evaluate group membership when processing DNS requests. CIE must be activated for
your tenant and you must
configure at least one directory before
you can create user group security rules.
You can reference standard directory groups synced through CIE and
cloud dynamic user groups defined directly
in CIE. Groups from multiple directories are all eligible as match criteria. Nested
group memberships are resolved recursively — if a user belongs to a child group,
they inherit the parent group's policy.
Policy rules are evaluated sequentially from top to bottom based on their priority
order. The first matching rule determines the DNS security profile applied to the
user's DNS traffic. Within a single rule, group membership is evaluated using OR
logic — the rule matches if the user belongs to any of the specified groups.
If a DNS request does not match any listed rule, the security profile assigned to
the connection source is applied. User group security policies currently apply to
Prisma Access Agent connection sources only.
You can configure up to 50 user group policy rules per tenant, with up to 50 groups
per rule.
Changes to user group security policies propagate almost instantly. However, if a rule
references new groups that have not yet been synced from CIE,
group membership changes take up to 10 minutes to be reflected in policy
evaluation. The Advanced DNS Security Resolver maintains a local cache of
identity data. If CIE becomes temporarily unavailable, existing policies continue to
be enforced using cached mappings. If a user's identity is not found in the cache,
the connection source profile applies.
When a DNS request matches a user group policy rule, the log entry includes the
requesting user in the Source User field and the name of the matched rule in
the Rule Name field.
