>
    Strata Copilot
    Synchronize DLP Configuration Objects to Child Tenants in Strata Multitenant Cloud Manager
    Focus
    Download PDF
    Focus
    1. Home
    2. Enterprise DLP
    3. Administration
    4. Configure Enterprise DLP
    5. Synchronize DLP Configuration Objects to Child Tenants in Strata Multitenant Cloud Manager
    Download PDF
    Enterprise DLP

    Synchronize DLP Configuration Objects to Child Tenants in Strata Multitenant Cloud Manager

    Table of Contents

    Synchronize DLP Configuration Objects to Child Tenants in Strata Multitenant Cloud Manager

    You can use Strata Multitenant Cloud Manager to maintain a standardized security baseline by pushing DLP configuration objects to one or more child tenants.
    Where Can I Use This?What Do I Need?
    • Strata Multitenant Cloud Manager
    • NGFW (Managed by Strata Cloud Manager)
    • Prisma Access (Managed by Strata Cloud Manager)
    • Prisma Browser
    • On the root-level parent tenant in Strata Multitenant Cloud Manager:
    • On child tenants:
      • Enterprise Data Loss Prevention (E-DLP) license
      • Active Enterprise DLP instance on one or more child tenants
    You push Enterprise Data Loss Prevention (E-DLP) configuration objects (such as DLP rules and detection methods) from the root-level parent tenant to one or more child tenants. This centralized approach reduces administrative overhead while allowing child tenants to supplement the global configuration with their own configuration objects where necessary.
    You manage pushed configuration objects only from the root-level parent tenant in Strata Multitenant Cloud Manager. For this reason, the ConfigurationData Loss Prevention navigation item is available only for the root-level parent, and you can't access Enterprise DLP when you select a child tenant in the hierarchy. Outside of Strata Multitenant Cloud Manager, you can still access the Enterprise DLP instance on a child tenant, but configuration objects pushed from the root-level parent tenant are read-only.
    You can synchronize the following configuration objects from the parent tenant to child tenants:
    • DLP Rules
      You can synchronize DLP rules and Endpoint DLP policy rules. When you push a rule, Strata Multitenant Cloud Manager automatically includes any required configuration objects that the rule references, such as data profiles and detection methods. If a child tenant already contains a required configuration object, Strata Multitenant Cloud Manager excludes that object from the push to prevent redundancy.
      If you enable end-user notifications for a DLP rule, Enterprise DLP cannot push the rule to the selected child tenants.
    • Detection Methods
      You can synchronize the following detection methods:
      You often don't need to push detection methods explicitly. When you push a DLP rule to child tenants, Enterprise DLP also pushes the detection methods that the rule requires.
      Because an exact data matching (EDM) dataset is encrypted using a key that is unique to the tenant, Strata Multitenant Cloud Manager does not support configuration synchronization for EDM datasets.
    • Settings
      You can synchronize the following settings:
      • Sensitive Data—You can push the settings for snippet viewing and masking.
      • Data Transfer—You can push the configuration for file-based settings, non-file-based settings, or both.

    Synchronize DLP Rules With Child Tenants in Strata Multitenant Cloud Manager

    Modify an Enterprise DLP rule on the root-level parent tenant and synchronize the configuration across selected child tenants.
    1. Log in to Strata Multitenant Cloud Manager.
    2. Navigate to the root-level parent tenant.
    3. Navigate to the DLP rules you want to synchronize.
      • ConfigurationData Loss PreventionDLP Rules
      • ConfigurationData Loss PreventionEndpoint DLP
    4. From the list of rules, select one or more rules.
    5. Push Config.
      The Multi Tenant Config Push flyout dialog lists all child tenants of the root-level parent tenant. Tenants without licensed instances of Enterprise DLP are grayed out, and you can't select them.
    6. In the Multi Tenant Config Push flyout dialog, complete the following actions:
      1. (Optional) Enter a Description for the push.
        This description appears in the audit log to help you and other administrators identify the purpose of the push.
      2. Select the tenants to which you want to synchronize the DLP rule configuration.
      3. Push Config.
      Enterprise DLP pushes the selected DLP rules to the selected child tenants. If the child tenants don't already have the data profiles or detection methods that a rule requires, Enterprise DLP also pushes those objects. The configuration push overrides any configuration conflicts on the child tenants.
      For exact data matching (EDM) datasets, Enterprise DLP pushes only the metadata, not the dataset, because the dataset is encrypted using a key that is unique to the tenant. The audit log shows that the configuration push was successful even though Enterprise DLP pushed only the metadata.
    7. Check the Config Push Logs to verify that Enterprise DLP pushed the DLP rule and its required objects to all selected child tenants.
      A configuration push can fail for individual child tenants, for example because of offline devices or licensing gaps.
      1. Select Audit Logs.
      2. On the Logs page, select Config Push Logs.
      3. Locate your configuration push request and check whether its status is Successful or Failed.
      4. If the status is Failed, click the Request ID for more information.
      5. In the flyout dialog, select Failed and view the Details.

    Synchronize Detection Methods With Child Tenants in Strata Multitenant Cloud Manager

    Modify a detection method on the root-level parent tenant and synchronize the configuration across selected child tenants.
    1. Log in to Strata Multitenant Cloud Manager.
    2. Navigate to the root-level parent tenant.
    3. Navigate to the type of detection method you want to synchronize:
      • Data patterns—Select ConfigurationData Loss PreventionDetection MethodsData Patterns.
      • Data dictionaries—Select ConfigurationData Loss PreventionDetection MethodsData Dictionaries.
      • Optical Character Recognition (OCR)—ConfigurationData Loss PreventionDetection MethodsOptical Character Recognition (OCR).
    4. To synchronize data patterns or data dictionaries, select one or more detection methods from the list.
    5. Push Config.
      The Multi Tenant Config Push flyout dialog lists all child tenants of the Strata Multitenant Cloud Manager root-level parent tenant. Tenants without licensed instances of Enterprise DLP are grayed out, and you can't select them.
    6. In the Multi Tenant Config Push flyout dialog, complete the following actions:
      1. (Optional) Enter a Description for the push.
        This description appears in the audit log to help you and other administrators identify the purpose of the push.
      2. Select the tenants to which you want to synchronize the configuration.
      3. Push Config.
      The configuration push overrides any configuration conflicts on the child tenants.
    7. Check the Config Push Logs to verify that Enterprise DLP pushed the detection methods to all selected child tenants.
      A configuration push can fail for individual child tenants, for example because of offline devices or licensing gaps.
      1. Select Audit Logs.
      2. On the Logs page, select Config Push Logs.
      3. Locate your configuration push request and check whether its status is Successful or Failed.
      4. If the status is Failed, click the Request ID for more information.
      5. In the flyout dialog, select Failed and view the Details.

    Synchronize DLP Settings With Child Tenants in Strata Multitenant Cloud Manager

    Synchronize Enterprise DLP settings from the root-level parent tenant across selected child tenants.
    1. Log in to Strata Multitenant Cloud Manager.
    2. Navigate to the root-level parent tenant.
    3. Navigate to the settings you want to synchronize:
      • Sensitive Data:
        1. Select ConfigurationData Loss PreventionSettingsSensitive Data.
        2. Select Add to Push Config for the snippet viewing and masking settings.
      • Data Transfer:
        1. Select ConfigurationData Loss PreventionSettingsData Transfer.
        2. Select Add to Push Config for each type of setting that you want to synchronize with the child tenants: file settings, non-file settings, or both.
    4. Push Config.
      The Multi Tenant Config Push flyout dialog lists all child tenants of the Strata Multitenant Cloud Manager root-level parent tenant. Tenants without licensed instances of Enterprise DLP are grayed out, and you can't select them.
    5. In the Multi Tenant Config Push flyout dialog, complete the following actions:
      1. (Optional) Enter a Description for the push.
        This description appears in the audit log to help you and other administrators identify the purpose of the push.
      2. Select the tenants to which you want to synchronize the configuration settings.
      3. Push Config.
      The configuration push overrides any conflicting settings on the child tenants.
    6. Check the Config Push Logs to verify that Enterprise DLP pushed the settings to all selected child tenants.
      A configuration push can fail for individual child tenants, for example because of offline devices or licensing gaps.
      1. Select Audit Logs.
      2. On the Logs page, select Config Push Logs.
      3. Locate your configuration push request and check whether its status is Successful or Failed.
      4. If the status is Failed, click the Request ID for more information.
      5. In the flyout dialog, select Failed and view the Details.

    © 2026 Palo Alto Networks, Inc. All rights reserved.