>
    Strata Copilot
    Social Login
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. Prisma Access Browser Administration
    4. Manage Prisma Browser Policy Rules
    5. Manage Prisma Browser Access and Data Control Rules
    6. Login Controls
    7. Social Login
    Download PDF
    Prisma Browser

    Social Login

    Table of Contents

    Social Login

    Configure the Social Login control to manage OAuth-based authentication through social identity providers on the Prisma Browser.

    Set the Social Login Control

    Prisma Browser DesktopPrisma Browser ExtensionPrisma Browser for Mobile
    Full supportFull supportNot available
    The Social Login control allows administrators to manage OAuth-based authentication through consumer social identity providers. When a user attempts to log in to a web application using a social login provider, the Prisma Browser intercepts the OAuth authorization request and enforces the configured policy.
    Google and Microsoft are dual-intent providers supporting both social (personal) and corporate (enterprise) logins. The Social Login control only restricts social and personal logins. Corporate logins through Google Workspace or Microsoft Entra ID are not affected by this control.
    The control is configured within the Access & Data policy rule wizard under Login ControlsSocial Login.
    Supported Providers
    ProviderOAuth Endpoints Monitored
    GoogleGoogle OAuth authorization endpoints
    MicrosoftMicrosoft OAuth and Live authorization endpoints
    FacebookFacebook OAuth dialog
    X (formerly Twitter)X/Twitter OAuth endpoints
    GithubGithub OAuth authorization
    LinkedInLinkedIn OAuth authorization
    AppleApple ID authorization
    To set the Social Login control:
    1. From Strata Cloud Manager, select PolicyRulesAccess & Data.
    2. Select a rule and navigate to Login ControlsSocial Login.
    3. Select one of the following options:
      • Allow all - The Prisma Browser allows login with any social login provider.
      • Block specific social login providers - Login with the selected social login providers is blocked. Login with other social login providers is allowed.
    4. (Block Specific only) Select the social login providers to block. Select at least one provider from the following:
      • Google
      • Microsoft
      • Facebook
      • X
      • Github
      • LinkedIn
      • Apple
    5. (Google only) Configure Google domain exclusions. When Google is selected as a blocked provider, configure the scope of the block:
      • All Google accounts blocked - All Google OAuth logins are blocked.
      • Exclude specific domains - Enter the domains to allow (for example, acme.com). Users with accounts on excluded domains can still log in with Google — this can be used to allow corporate Google logins while blocking social logins.
    6. Set MFA requirements. Select Require additional MFA prior to login to enforce multi-factor authentication before any social login attempt is allowed.
      MFA is only available when the effect is set to Allow all. MFA configuration does not apply on the Prisma Browser Extension.
    7. Set prompt behavior. When blocking specific providers, select one of the following options:
      • None - No prompt is displayed.
      • Warn and allow to proceed anyway - Inform the user about the restriction and allow the user to continue.
      • Warn and allow to proceed anyway with a reason - Inform the user about the restriction. The user must provide a reason to continue.
      • Permission request - Allow the user to send a permission request to the administrator.
      When a prompt option is selected, configure the bypass time frame. Select how long the bypass remains active after the user proceeds or receives approval.
      The Prompt option is only available when blocking specific providers.
    8. Customize dialog text. Configure the message displayed when a social login is blocked. To set the text, click Set dialog text.
    9. Click Set.

    End User Experience

    When the Prisma Browser blocks a social login, the behavior varies by provider:
    ProviderBlocking Behavior
    Google (no domain exclusions)The OAuth request is cancelled. The user is redirected to the originating page.
    Google (with domain exclusions)The login flow is restricted to enterprise accounts on allowed domains only. Personal accounts are blocked.
    MicrosoftThe login flow is restricted to organizational accounts. Consumer/personal Microsoft accounts are blocked.
    Apple, Facebook, Github, LinkedIn, XThe OAuth request is cancelled. The user is redirected to the originating page.
    Google Special Handling
    When Google is blocked with domain exclusions configured, the Prisma Browser restricts the Google login flow to accounts matching the allowed domains. The browser injects parameters that limit account selection to enterprise accounts only. If a user's account does not match an allowed domain, the login is rejected by Google.
    Microsoft Special Handling
    When Microsoft is blocked, the Prisma Browser restricts the login flow to organizational accounts by redirecting from consumer authentication paths to the enterprise authentication endpoint. Personal Microsoft accounts (Outlook.com, Hotmail, Xbox Live) are blocked from authenticating.

    Events

    The Prisma Browser generates events when the Social Login control is enforced:
    EventTriggerKey Fields
    Login Attempt (Blocked)A social login attempt matches a blocking policyRule ID, URL, login method (Social), identity provider URL, policy action
    Login Attempt (Bypassed)A user bypasses a blocked login via promptRule ID, URL, login method, bypass reason
    Events are not generated when the policy action is "Allow".

    Limitations

    • Mobile platform is not supported.
    • MFA is only available when the effect is set to "Allow all".
    • The Prompt option is only available when blocking specific providers (not when set to "Allow all").

    © 2026 Palo Alto Networks, Inc. All rights reserved.