Analyze Sign-in Rule Evaluations
Learn how to analyze sign-in rule evaluations to understand why a device was allowed,
blocked, or prompted during the Prisma Browser sign-in process.
| Where Can I Use This? | What Do I Need? |
|---|
- Strata Cloud Manager
- Prisma Browser standalone
|
- Prisma Access with Prisma Browser bundle license or
Prisma Browser standalone license
- Superuser or Prisma Browser
role
|
Sign-in Rule Check Analysis provides administrators with detailed visibility into
how sign-in rules are evaluated when a user attempts to access Prisma Browser .
Instead of manually comparing device attributes against device group requirements, the
analysis shows a priority-ordered breakdown of each evaluated rule, the device groups
within it, and the individual posture attributes that matched or failed — reducing
sign-in investigation time from approximately 20 minutes to under one minute.
The analysis is available in the event drawer when viewing a sign-in event. It displays
all evaluated rules in priority order as a waterfall flow, with drill-down capability to
inspect exactly which device group attributes caused a match or mismatch.
The sign-in rule check analysis evaluates against the latest
policy version only. Historical policy versions are not supported at this time.
How Sign-in Rule Evaluation Works
When a user attempts to access Prisma Browser, the system evaluates sign-in rules
in priority order (highest priority first) until it finds a rule whose scope matches
the user and device. The first matching rule's action (Allow, Block, or Prompt) is
enforced. Rules with lower priority than the matched rule are not evaluated.
Evaluation logic:
- Between rules — First-match priority. Prisma Browser evaluates rules
from highest to lowest priority and stops at the first match.
- Between device groups within a rule — OR logic. A rule matches if at
least one of its device groups matches the device.
- Between attributes within a device group — AND logic. All enabled posture
attributes in a device group must match for that group to match.
- Location and Network scope — AND logic with device groups. If a rule
defines location or network conditions, the device must also satisfy those
conditions in addition to matching a device group.
View the Sign-in Rule Check Analysis
To view the sign-in rule check analysis for an event:
- Select and click an event row to open the event drawer.
- Expand the Sign-in rule check section.
The section displays a vertical list of all evaluated rules in priority order. Each
rule card shows:
- Priority — A numbered indicator showing the rule's evaluation
order.
- Name — The rule's display name.
- Action — The configured action (Allow, Block, or Prompt).
- Status — Whether the rule was Applied (matched and enforced) or Skipped
(evaluated but not matched).
Rules with lower priority than the applied rule are not
shown because they were never evaluated by the engine.
Analyze a Rule in Detail
Click any rule card to open the full-screen Sign-in check analysis modal.
Modal layout
- Header — Shows the device serial number, operating system, user name
and email, and the sign-in date and time.
- Left panel — The rule list, serving as navigation. Click any rule to
view its analysis.
- Right panel — The detailed analysis for the selected rule.
Rule detail panel
The rule detail panel displays:
- Rule name — With a link to the rule's configuration page in Sign-in
Rules settings (opens in a new tab).
- Metadata — Device group count, configured action, last updated date,
and evaluation result (Applied or Skipped).
- Device groups — Each device group shown as an expandable accordion
with its match status.
- Location and Network — If the rule includes location or network scope
conditions, the analysis displays whether the device's geolocation and
network matched the configured requirements.
Between device groups, an or label indicates that only one group needs to
match for the rule to apply.
Device group status indicators
| Status | Indicator | Meaning |
|---|
| Matched | Green pill with check icon | All required attributes in this device group match the
device |
| Unmatched | Red pill with X icon | One or more required attributes in this device group do not
match the device |
Each device group accordion includes a link to navigate directly to the device
group management page (opens in a new tab).
Review Attribute Comparisons
Expand a device group to view the attribute comparison table. This table shows how
the actual device posture compares to the administrator's configured requirements for
each attribute in the group.
Table columns
| Column | Description |
|---|
| Attribute name | The posture attribute being evaluated |
| Device setting | The value reported by the actual device |
| Admin requirements | The value configured by the administrator in the device
group |
| Attribute check | Green checkmark (match) or red X (mismatch) |
Attribute display types
Depending on the attribute type, the comparison table uses different display
formats:
- Simple comparison — Shows the device value and the required value
side by side (e.g., Screen Lock: "Active" vs. required "Active").
- Vendor list — Shows vendor icons and names for security products
(e.g., Endpoint Protection vendors with active/inactive status).
- Detail list — Shows individual items that passed or failed (e.g.,
specific running processes or files with their check results).
- Text statement — Shows a descriptive sentence explaining the
compliance status (e.g., certificate compliance or serial number
match).
If the device group has no enabled posture requirements,
the analysis displays: "The device group attribute is configured to
any."
Status and Visual Indicators
Rule-level indicators
| Element | Applied rule | Skipped rule |
|---|
| Priority circle | Solid filled with white number | Hollow circle with muted number |
| Connector | Dashed vertical line | Dashed vertical line |
| Status pill | "Applied" (highlighted) | "Skipped" (secondary) |
| Action pill | Colored (green = Allow, yellow = Prompt, red =
Block) | Muted grey |
Attribute-level indicators
| Result | Icon | Meaning |
|---|
| Match | Green checkmark | The device posture matches the admin requirement |
| Mismatch | Red X | The device posture does not match the admin
requirement |
