>
    Strata Copilot
    Deploy the Endpoint DLP Configuration Profile for Prisma Access Agent Using Microsoft Intune
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access Agent
    3. Prisma Access Agent Administration
    4. Deploy the Prisma Access Agent
    5. Deploy Prisma Access Agents Using Microsoft Intune
    6. Deploy Prisma Access Agents to macOS Endpoints Using Microsoft Intune
    7. Deploy the Endpoint DLP Configuration Profile for Prisma Access Agent Using Microsoft Intune
    Download PDF
    Prisma Access Agent

    Deploy the Endpoint DLP Configuration Profile for Prisma Access Agent Using Microsoft Intune

    Table of Contents

    Deploy the Endpoint DLP Configuration Profile for Prisma Access Agent Using Microsoft Intune

    Deploy the Endpoint DLP configuration profile to pre-authorize DLP system extensions on managed macOS endpoints.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Strata Cloud Manager)
    • Prisma Access (Managed by Panorama)
    • NGFW (Managed by Panorama)
    • Check the prerequisites for the deployment you're using
    • Prisma Access Agent
    • macOS endpoints managed by Microsoft Intune
    • Endpoint DLP license
    Endpoint DLP inspects and protects sensitive data by deploying two system extensions alongside the Prisma Access Agent: an endpoint security extension (com.paloaltonetworks.pangdlp.enforcer) and a network filter extension (com.paloaltonetworks.pangdlp.netfilterdlp). macOS requires that system extensions be authorized by MDM before the installer runs; without this authorization, macOS prompts users to approve each extension manually.
    The Endpoint DLP configuration profile pre-authorizes these extensions, grants full disk access to DLP processes, and configures the DLP content filter. Deploy this profile to your target device groups before running the Prisma Access Agent installer.
    1. If you have not already done so, deploy the basic to the same device groups before continuing.
    2. Deploy the Endpoint DLP configuration profile.
      1. Prepare a .mobileconfig file for the Endpoint DLP profile with the following content:
        <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
   <key>PayloadContent</key>
   <array>
       <dict>
           <key>FilterDataProviderBundleIdentifier</key>
           <string>com.paloaltonetworks.pangdlp.netfilterdlp</string>
           <key>FilterDataProviderDesignatedRequirement</key>
           <string>identifier "com.paloaltonetworks.pangdlp.netfilterdlp" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU]=PXPZ95SK77</string>
           <key>FilterSockets</key>
           <true/>
           <key>FilterType</key>
           <string>Plugin</string>
           <key>PayloadDisplayName</key>
           <string>DLP Content Filter Payload</string>
           <key>PayloadIdentifier</key>
           <string>4983AFAC-FC72-4853-8F3F-4F2BDBC3FDC4</string>
           <key>PayloadOrganization</key>
           <string>Palo Alto Networks Inc.</string>
           <key>PayloadType</key>
           <string>com.apple.webcontent-filter</string>
           <key>PayloadUUID</key>
           <string>4983AFAC-FC72-4853-8F3F-4F2BDBC3FDC4</string>
           <key>PayloadVersion</key>
           <integer>1</integer>
           <key>PluginBundleID</key>
           <string>com.paloaltonetworks.pangdlp</string>
           <key>UserDefinedName</key>
           <string>PAA DLP Content Filter</string>
       </dict>
       <dict>
           <key>PayloadDescription</key>
           <string></string>
           <key>PayloadDisplayName</key>
           <string>PRIVACY_PREFERENCES_POLICY_CONTROL</string>
           <key>PayloadEnabled</key>
           <true/>
           <key>PayloadIdentifier</key>
           <string>7A2547E1-121F-46CF-A8B0-DD963954F548</string>
           <key>PayloadOrganization</key>
           <string>Palo Alto Networks Inc.</string>
           <key>PayloadType</key>
           <string>com.apple.TCC.configuration-profile-policy</string>
           <key>PayloadUUID</key>
           <string>7A2547E1-121F-46CF-A8B0-DD963954F548</string>
           <key>PayloadVersion</key>
           <integer>1</integer>
           <key>Services</key>
           <dict>
               <key>SystemPolicyAllFiles</key>
               <array>
                   <dict>
                       <key>Allowed</key>
                       <true/>
                       <key>CodeRequirement</key>
                       <string>identifier "com.paloaltonetworks.pangdlp.enforcer" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = PXPZ95SK77</string>
                       <key>Identifier</key>
                       <string>com.paloaltonetworks.pangdlp.enforcer</string>
                       <key>IdentifierType</key>
                       <string>bundleID</string>
                       <key>StaticCode</key>
                       <false/>
                   </dict>
                   <dict>
                       <key>Allowed</key>
                       <true/>
                       <key>CodeRequirement</key>
                       <string>identifier "com.paloaltonetworks.pangdlp" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = PXPZ95SK77</string>
                       <key>Identifier</key>
                       <string>com.paloaltonetworks.pangdlp</string>
                       <key>IdentifierType</key>
                       <string>bundleID</string>
                       <key>StaticCode</key>
                       <false/>
                   </dict>
               </array>
           </dict>
       </dict>
       <dict>
           <key>AllowUserOverrides</key>
           <true/>
           <key>AllowedSystemExtensions</key>
           <dict>
               <key>PXPZ95SK77</key>
               <array>
                   <string>com.paloaltonetworks.pangdlp.enforcer</string>
                   <string>com.paloaltonetworks.pangdlp.netfilterdlp</string>
               </array>
           </dict>
           <key>AllowedSystemExtensionTypes</key>
           <dict>
               <key>PXPZ95SK77</key>
               <array>
                   <string>EndpointSecurityExtension</string>
                   <string>NetworkExtension</string>
               </array>
           </dict>
           <key>PayloadDescription</key>
           <string></string>
           <key>PayloadDisplayName</key>
           <string>SYSTEM_EXTENSION_POLICY</string>
           <key>PayloadIdentifier</key>
           <string>1169B0FF-3642-49D1-931A-C18790E24D9B</string>
           <key>PayloadOrganization</key>
           <string>Palo Alto Networks Inc.</string>
           <key>PayloadType</key>
           <string>com.apple.system-extension-policy</string>
           <key>PayloadUUID</key>
           <string>1169B0FF-3642-49D1-931A-C18790E24D9B</string>
           <key>PayloadVersion</key>
           <integer>1</integer>
           <key>RemovableSystemExtensions</key>
           <dict>
               <key>PXPZ95SK77</key>
               <array>
                   <string>com.paloaltonetworks.pangdlp.enforcer</string>
                   <string>com.paloaltonetworks.pangdlp.netfilterdlp</string>
               </array>
           </dict>
       </dict>
   </array>
   <key>PayloadDescription</key>
   <string></string>
   <key>PayloadDisplayName</key>
   <string>PAA EDLP extensions</string>
   <key>PayloadEnabled</key>
   <true/>
   <key>PayloadIdentifier</key>
   <string>0B259544-BF7D-42D8-B006-BC8AB719B1E4</string>
   <key>PayloadOrganization</key>
   <string>Palo Alto Networks Inc.</string>
   <key>PayloadRemovalDisallowed</key>
   <true/>
   <key>PayloadScope</key>
   <string>System</string>
   <key>PayloadType</key>
   <string>Configuration</string>
   <key>PayloadUUID</key>
   <string>0B259544-BF7D-42D8-B006-BC8AB719B1E4</string>
   <key>PayloadVersion</key>
   <integer>1</integer>
</dict>
</plist>
      2. In the Microsoft Intune admin center, go to DevicesmacOSConfiguration.
      3. Select CreateNew Policy.
      4. Set the Profile type to Templates, select Custom, and click Create.
      5. Enter a policy name, upload the Endpoint DLP .mobileconfig file you created, and assign it to the same groups targeted by your Prisma Access Agent deployment.
    3. Verify the configuration profiles are correctly applied on enrolled endpoints.

    © 2026 Palo Alto Networks, Inc. All rights reserved.