New Features - Prisma Agent - 26.3

To protect against attackers who spoof reverse DNS responses to bypass tunnel enforcement, Prisma® Agent now validates the internal gateway's TLS certificate as part of internal host detection.

To strengthen the security of network detection, the agent now adds certificate-based validation of the internal gateway after the reverse DNS lookup succeeds. Because the gateway's identity is cryptographically bound to its certificate, this additional step provides stronger assurance that the endpoint is genuinely on the internal network before the tunnel is suppressed.

This behavior is automatic. No additional configuration is required — if you have Internal Host Detection and internal gateways configured in Agent Settings, advanced internal host detection activates automatically. If you have Internal Host Detection configured without internal gateways, the agent continues to use only the reverse DNS lookup.

This feature applies only to the Internal Host Detection configuration in Agent Settings. You enable advanced internal host detection by configuring Internal Host Detection and internal gateways in Agent Settings.

You can now use the Best Available - Fail Safe connectivity option with Linux agents in forwarding profiles, extending the same secure tunnel enforcement that was previously available only on macOS and Windows agents.

When you apply Best Available - Fail Safe to a forwarding rule, Linux agents route matching traffic through the Prisma® Access tunnel to the nearest gateway for inspection and policy enforcement. If a Linux user can't connect to the tunnel, or if the traffic type is unsupported, the option blocks access to maintain security (unlike Best Available - Fail Open, which allows traffic to proceed unprotected in those cases). This behavior makes Best Available - Fail Safe the appropriate choice when security posture cannot be compromised, such as for sensitive corporate applications or regulated data.

To use this feature, assign Best Available - Fail Safe as the connectivity option in a forwarding profile rule. Linux agents require Prisma Access Agent 26.3 or later.

To help your Linux endpoints meet the same device-trust requirements as Windows and macOS, Prisma® Agent now supports client certificate authentication on Linux starting in version 26.3. You can enforce consistent certificate-based policies across your desktop endpoints.

Linux certificate authentication integrates with Cloud Identity Engine and supports three authentication methods: Client Certificate only, Client Certificate OR SAML, and Client Certificate AND SAML. These are the same methods available on Windows and macOS, giving you a single, consistent authentication policy across Windows, macOS, and Linux endpoints.

On Linux, Prisma Agent discovers client certificates from standard file-based certificate stores. You configure selection criteria—such as issuer, validity period, and Extended Key Usage (EKU) OIDs—to ensure the right certificate is always used for authentication. When multiple valid certificates match your criteria, Prisma Agent can prompt users to choose one, or automatically select it if only one certificate matches.

Configure Linux certificate selection criteria and additional parameters through certificate selection settings.

You can now enforce Forwarding Profile policies on container traffic on Linux, ensuring that Docker workloads follow your split-tunnel rules — the same rules that govern host traffic — without additional configuration. Prisma® Agent evaluates each container connection against your Forwarding Profile rules and assigns a verdict: Tunnel, Direct, Block, or Best Available - Fail Safe . Container networks don't need to exist before the agent starts, and no per-container configuration is required.

To use this feature, your Linux endpoint must run kernel 5.11 or later. Run uname -r to check your kernel version. Arch Linux ARM (aarch64) endpoints may require kernel recompilation to enable the BTF support this feature depends on.

A few behavioral differences apply in this release: Forwarding Profile rules that match by application name don't apply to DNS queries that containers route through systemd-resolved or Docker's internal resolver — domain-based DNS rules work as expected. Blocked DNS queries time out rather than failing immediately. IPv6 traffic from containers can be blocked or allowed direct but isn't steered through the tunnel.

You can review all behaviors and considerations in Container Traffic Support for Linux.

You can now configure Prisma® Agent on iOS endpoints to use the default system browser, such as Safari, for SAML authentication, giving users a frictionless authentication experience. When Prisma Agent opens the default browser, users who have an active session with their identity provider (IdP), such as Okta or Microsoft Entra ID, can authenticate without re-entering their credentials. After authenticating, a prompt appears asking them to return to the Prisma Agent app. You can find configuration steps in Configure Prisma Agent to Use the Default System Browser for SAML Authentication.

When you set up app settings rules for Prisma® Agent, you can already filter by OS and user entity—and now you can also filter by device attributes. Device attribute match criteria let you assign different app settings to endpoints based on Windows registry keys, macOS plist entries, and device certificates, giving you fine-grained control over which configuration each endpoint receives.

Registry key checks verify whether a specified registry key—or specific value entries under it—exists on the endpoint, with optional negation to match endpoints where the key is absent. Plist checks verify whether a specified plist domain and optional key entries exist on macOS.

Certificate checks apply to Windows and macOS endpoints only and search both the user certificate store and the machine certificate store for a valid certificate issued by a specified CA as the direct issuer; certificates where the CA appears elsewhere in the chain do not match. OCSP-based revocation checks are not supported for certificate profile checks.

Configure a default rule with no device match criteria to ensure all users have a fallback configuration if no other rule matches. Configure agent settings to set up device attribute match criteria.

Managing diverse infrastructure needs across corporate offices and remote work environments requires flexible traffic routing. Dynamic location-based steering addresses this challenge by enabling you to route traffic based on user physical location or network. When you deploy Prisma® Agent with this feature, the agent detects user location through Internal Host Detection or source IP address matching and applies the appropriate forwarding profile rules automatically.

You can configure different traffic steering behaviors for each office location in your forwarding profiles by adding user location as a matching criterion. This allows you to optimize traffic routing based on where users connect from, ensuring that security policies remain enforced while respecting local network infrastructure. The agent evaluates forwarding profile rules in priority order, matching traffic to the first rule where all criteria including user location are satisfied.

You might use this feature if your organization operates offices with varying network infrastructure or if you need to route traffic differently when users work from branch offices. You configure user locations in Strata Cloud Manager by defining detection criteria using either of the two supported methods, Internal Host Detection or source IP address lists, then reference those locations in your forwarding profile rules alongside existing criteria such as destination addresses and source applications.

Update (Prisma Agent 26.3): Dynamic location-based steering now supports Linux endpoints, so you can apply location-based forwarding rules consistently across macOS, Windows, and Linux agents without separate configurations.

Granular certificate selection gives you precise control over which certificates Prisma® Agent uses for authentication, preventing incorrect User-ID mapping that occurs when the agent selects the wrong certificate. This feature is now configurable directly in the Agent Settings, in addition to the existing config.json deployment method.

You configure certificate selection through two criteria: certificate store filtering, which determines whether the agent searches the user store, the machine store, or both; and Extended Key Usage (EKU) OID filtering, which restricts authentication to certificates issued for specific purposes, such as client authentication or smart card logon. Together, these criteria ensure the agent consistently selects the correct certificate for accurate user identification and effective security policy enforcement.

When you configure these settings in the Agent Settings, they are pushed to endpoints as part of the standard configuration update and take precedence over config.json settings from the second login onwards. The settings persist through reboots, restarts, and agent upgrades.

IPv6 dual-stack support for Prisma® Agent enables you to steer both IPv4 and IPv6 traffic. You can configure forwarding profiles with IPv6 addresses alongside existing IPv4 rules to control how traffic reaches applications. This feature prepares your deployment for the growing adoption of IPv6 in enterprise networks while maintaining full IPv4 compatibility. You can access applications configured with IPv6 addresses and leverage IPv6 performance benefits by bypassing Carrier-Grade NAT limitations common on modern mobile networks. The agent creates a virtual adapter that will accommodate both IPv4 and IPv6 address pools configured on the gateway. Internal Host Detection is not supported at this time for IPv6, so only IPv4 reverse DNS queries can be made to determine when tunnel suppression is appropriate. The Endpoint Manager inventory displays IPv4 public and both IPv4 and IPv6 private addresses to assist with troubleshooting network connectivity issues.

Update (Prisma Agent 26.3) : IPv6 dual-stack support is now available on iOS. Prisma Agent on iOS can steer both IPv4 and IPv6 traffic using the same forwarding profile configuration as Windows and macOS, giving your mobile users consistent policy enforcement and IPv6 performance benefits in dual-stack network environments.

If your organization uses Jamf to manage macOS devices, you can now enforce MDM compliance checks for Prisma® Agent tunnel authorization, extending the same compliance-based access control that Microsoft Intune provides for Windows devices to your macOS fleet.

You configure the Jamf integration in your MDM integration settings by providing your Jamf instance Host URL, a client ID, and a client secret. The Endpoint Manager polls Jamf at configurable intervals to sync device compliance status and performs real-time queries when a device is not found in its cache or shows as non-compliant. Devices that are not enrolled in Jamf or fail compliance checks are blocked from establishing a tunnel. If Endpoint Manager detects that a device is out of compliance at the time of polling, any active tunnels are torn down and the user is notified.

When authentication fails during initial enrollment and you can't access the Prisma® Agent Settings page, you can now tap ? in the top-right corner of the enrollment page to open a share sheet with a diagnostic log archive. You can send the archive to your IT administrator without completing enrollment first.

On iOS, you can share the archive via AirDrop, Messages, Mail, or other apps.

The help button gives your IT administrator the diagnostic data needed to troubleshoot authentication failures, network issues, or configuration problems that occur before enrollment completes.

To share logs from the enrollment page on iOS, see Use the Prisma Agent App for iOS (Unmanaged Devices) and Use the Prisma Agent App for iOS (Managed Devices).

Prisma® Agent now maintains secure connections and enforces security policies automatically during Endpoint Manager outages, eliminating disruptions caused by a cloud region failure.

Endpoint Manager now runs simultaneously across multiple geographic regions. If a region becomes unavailable, traffic routes automatically to a healthy region within minutes — your users stay connected, policies stay enforced, and application access through Prisma Access gateways continues without interruption. No manual steps are required during or after the transition.

This multi-region design also improves resilience beyond regional outages. If agents lose all cloud connectivity — for example, at a remote site with an extended network outage — Prisma Agent enforces the last cached security policy for up to 7 days, so users can continue working safely without re-authenticating. When connectivity returns, agents pace their reconnection automatically to avoid overwhelming the service.

Staged upgrade rollouts resume automatically after service restoration, and regional failovers respect your tenant's data residency configuration, so traffic stays within its designated geographic boundary during failover.

Prisma Agent Service Continuity describes full agent behavior during outages, including how to manage configuration commits and rollouts after a failover.

Prisma® Agent automatically selects the best-performing gateway for users through Best Location — and now users also have the flexibility to pin a specific location using preferred gateway selection, giving them consistent connectivity to the gateway that works best for their needs. Users set their preferred gateway by selecting a location from the Location drop-down; a star icon appears next to the selected location to indicate it is pinned. The agent then reconnects to that location after network changes, sleep/wake cycles, reboots, and other external factors such as WebSocket connection issues and token expiry — without requiring users to reselect it each time. To return to automatic selection, users choose Best Location, which clears the preferred gateway. This feature is available on Windows and macOS endpoints.

Organizations transitioning to Prisma® Agent face challenges when their existing authentication infrastructure uses LDAP/LDAPS, as Prisma Agent previously only supported SAML and certificate authentication through Cloud Identity Engine (CIE). This can create significant adoption barriers, especially in regions where LDAP usage is prevalent. LDAP support for Prisma Agent addresses this challenge by enabling you to leverage your existing GlobalProtect® portal LDAP authentication infrastructure, eliminating the need to reconfigure authentication methods when migrating to Prisma Agent.

With LDAP authentication support, you can now configure your Prisma Agent to authenticate users against your existing directory services through the GlobalProtect portal. This integration provides a seamless authentication experience for your users while maintaining your existing security policies. The feature supports all standard LDAP configuration options, including Base DN, Bind DN, multiple LDAP servers, SSL/TLS secure connections, and server certificate verification for SSL sessions. You can also combine LDAP authentication with client certificate authentication using AND/OR logic to meet your specific security requirements.

The enhanced user experience includes support for saved user credentials, enabling seamless authentication across device states such as sleep-wake cycles, hibernation, and network transitions. When properly configured, users won't need to repeatedly enter their credentials after logging into their operating system.

By supporting LDAP authentication through the GlobalProtect portal, Prisma Access Agent provides you with a smoother migration path from GlobalProtect to Prisma Access Agent, preserving your authentication setup while enabling you to transition to a newer access agent. This feature is valuable for existing deployments where reconfiguring authentication methods would otherwise increase deployment complexity and time.

Update (Prisma Agent 26.3): LDAP authentication for Prisma Agent is now available on iOS endpoints. The authentication experience on iOS is consistent with macOS and Windows. When your users connect, the app prompts them to enter their LDAP username and password, and your existing GlobalProtect portal LDAP configuration handles the authentication. No changes to your existing LDAP configuration are required to support iOS devices.

Prisma® Agent now includes self-healing, which automatically applies remediation steps when a user reports a connectivity problem — helping users get back online faster and reducing the help desk tickets that unresolved connectivity issues generate.

When a user selects Report An Issue from the agent, the agent immediately applies local actions to restore the connection. At the same time, it collects and uploads the user's diagnostics for AI-powered analysis. Based on the specific errors identified, the system can instruct the agent to apply additional remediation steps. The user's connection may be temporarily interrupted during this process — no action is required.

After remediation completes, a dialog prompts users to indicate whether the fix resolved the issue. If the issue persists, the uploaded diagnostics remain available in Endpoint Management for your review.

Self-healing runs automatically — no additional steps are required from users beyond reporting the issue. It is available on Windows and macOS desktop devices. You enable self-healing from the Strata Cloud Manager agent settings, independently of other Endpoint Insights features.

To learn more, see Self-Healing for Prisma Agent.

Previously, installing Prisma® Agent on Linux required the sudo -E flag to preserve your desktop environment so the agent UI could launch automatically after installation. The -E flag was easy to omit, causing installation failures or a UI that didn't start. Starting with version 26.3, you no longer need sudo -E for any install, upgrade, or uninstall operation.

In version 26.3, you run the same command regardless of your session type — no sudo prefix required. The installer internally handles privilege escalation and prompts you for your sudo password only when it needs elevated access. From a desktop session, run the AppImage directly as your user. The installer preserves your desktop environment automatically and launches the agent UI when installation completes. From a remote session over SSH or RDP, the installer completes successfully but displays a warning that the user environment isn't preserved and the agent UI won't launch automatically. You can start the UI from the desktop Applications menu, or it starts automatically the next time you log in to a desktop session.

This change applies to install, upgrade, and uninstall operations on all supported Linux distributions. You can find the updated commands in Install the Prisma Agent (Linux).

Prisma® Agent 26.3 adds support for Ubuntu 26.04 LTS on x86_64 and ARM64 endpoints, extending Linux desktop coverage to the latest Ubuntu long-term support release. You can deploy Prisma Agent on Ubuntu 26.04 using the AppImage installer, gaining zero trust network access, network traffic inspection and policy enforcement, and centralized endpoint management through the same administrative workflows you use for your other supported Linux platforms. Ubuntu 26.04 joins Ubuntu 22.04 and 24.04, Arch Linux, Fedora 42 and 43, Debian 13, NixOS, Oracle Linux 9.7, and Red Hat Enterprise Linux 9.6 and 10.0 in the supported Linux lineup. You can find installation steps and the full list of supported operating systems in Install the Prisma Agent (Linux).