Configure Entra ID for Prisma Browser Application Sync

1. Application Registration in Entra

   You must register the application in the Azure Portal to establish a secure trust relationship between Microsoft Entra ID and Prisma Browser.

   1. Sign in to the Azure Portal.
   2. Navigate to Azure Active Directory → App registrations → + New registration.
   3. Enter a descriptive name for the application.
   4. Select Single tenant only as the supported account type.
   5. Under Redirect URI, select Single-page application (SPA) and enter the following URI:
   6. Click Register.

2. Configuring API Permissions

   Granting the following permissions allows the Prisma Browser to read user information and application assignments. This integration follows the principle of least privilege, requesting only the specific access required for operation.

   1. Navigate to your new application's App permissions and click + Add a permission.
   2. Select Microsoft Graph.
   3. Add the following Application permissions:
      • Application.Read.All
      • DelegatedPermissionGrant.Read.All
   4. Add the following Delegated permissions:
      • Application.Read.All
   5. Click Grant admin consent for <your tenant name> and confirm by selecting Yes in the pop-up.

   User.Read

   is added automatically; do not remove this permission.

   Permissions Overview

   Typee	Permission Name	Purpose
   Delegated	User.Read	Verifies the identity of the browser-connected user.
   Delegated	Applicationn.Read.All	Fetches the applications for the logged-in user.
   Application	Application.Read.All	Validates the administrator-configured integration.
   Application	DelegatedPermissionGrant.Read.All	Validates the administrator-configured integration.

3. Generating the Client Secret

   1. Go to Certificates & Secrets → + New client secret.
   2. Provide a description (e.g., "Microsoft secret 01").
   3. Set the Expires field to 730 days (24 months).
   4. Click Add.
      Important: Copy the generated secret value immediately. You will need this for the next step, and it cannot be retrieved later.

4. Connect to Prisma Browser

   1. In the Prisma Browser Admin Console, go to Integrations.
   2. Select IdP Applications Sync Integration
   3. Click + Add Provider or Connect your first provider.
   4. Select Entra ID.
   5. Enter the Client Secret (from Step 3), the Application (client) ID, and the Directory (tenant) ID (found in the Azure Portal's Application Overview).
   6. Click Test provider connection to verify settings, then click Add Provider.
5. Activate the Sync Rule

   1. Open your Browser Customization rules and create a new rule.
   2. Under New Tab and Home Page, select the Identity Provider Synced Shortcuts control.
   3. Enable the feature, select Entra ID, and choose the specific integration created in Step 4.
   4. Click Set.