Microsoft Entra ID Certificate Enforcement

1. Obtain rhe Prisma Access Browser Root Certificate

   1. Go to the Prisma Access Management Console and select Administration > Integrations.
   2. Select and enable Google Workspace Integration.
   3. In the first section, click Prisma Access Certificate to download the unique tenant root certificate.
   4. Save the certificate to the Base-64 encoded (X.509) - .cer format.

   • Windows - Select Open the certificate > details > copy to file and save it in the new format.
   • macOS / Linux - Use OpenSSL.
2. Configure Policy to Send Certificate

   1. Go to the Prisma Access Management Console and select Policy > Rules > Browser Customization.
   2. Create a rule that targets the relevant scope of Users.
   3. Enable the Custom Browser Preferences control and choose Custom prefs. Enter the following:

      {  "talon.chrome_enterprise_policies": {  "AutoSelectCertificateForUrls": [    "{\"pattern\":\"https://[*.]certauth.login.microsoftonline.com\",\"filter\":{\"ISSUER\":{\"O\":\"Talon Endpoint Verification\"}}}"  ]  }}

   4. Save and apply the policy.
3. Configure the CBA in the Entra ID

   The following steps display the directions for a basic sample CBA configuration. The configuration required for each organization will be different. Refer to How to configure Microsoft Entra certificate-based authentication for help with configuring more complex scenarios.

   1. Upload the Prisma Access root CA.
      • Log in to the Microsoft Entra Admin Center.
      • Navigate to Protection > Security Center > Certificate authorities.
      • Upload the Prisma Access root certificate, configured to be a root CA.
   2. Configure the CBA.
      • Navigate to Protection > Authentication Methods > Policies.
      • Open Certificate based authentication.
      • Click Enable.
      • Configure the User Groups that will be using Prisma Access with Certificate based enforcement.
      • Click the Configure tab.
      • Select multi-factor authentication with Low affinity.
      • Add an authentication binding rule with the Prisma Access root CA.
      • Add a user name binding rule using the RFC822Name certificate field and the CertificateUserIDs user attribute.
   3. Update the User Properties:
      This step will configure all relevant Prisma Access users with a property bound to the issued certificate. You can do this manually or automatically using the API/Powershell.

      • Edit the user Properties > Identity > Authorization Info. Add the "Certificate user IDs" property with value: "X509:<RFC822>user-email" (For example "X509:<RFC822>user@example.com").
   4. Test the CBA Authentication.
      • Login to an SSO application using a Prisma Access-CBA-enabled user.
      • Select Certificate Based Authentication- authentication should succeed.
      • Test this by signing in using another browser/authentication. The authentication should fail as the relevant client certificate is not available in the browser.
4. Configure the application.

   This configuration enables you to ensure that access to select secure applications will be available only from the `Prisma Access Browser using CBA with the Conditional Access Feature.

   1. Create a custom Authentication Strength for the Prisma Access certificate.
      • Open the Microsoft Entra Admin Center.
      • Navigate to Protection > Authentication methods > Authentication strengths.
      • Create a new Authentication Strength.
      • Select only Certificate-based authentication (Multifactor).
      • Select advanced and choose the Prisma Access root CA to allow under this authentication strength.
   2. Create a Conditional Access Policy.

   • Navigate to Applications > Enterprise applications > Conditional Access > Policies .
   • Create a new Conditional Access Policy.
   • In the Users section, select the Target Users.
   • Under Target resources, select the target applications.
   • Select Grant and Select requiring the authentication strength you created in the previous step.

   This will ensure that authentication for the chosen applications will only be allowed from Prisma Access using CBA. Re-test the login to ensure that login is now possible only using Certificate-based authentication.