Use the Prisma Agent App for Android (Managed Devices)

1. Open the Prisma Agent app by tapping the PA Agent icon.
2. If this is the first time you are logging in, select or enter the project name your administrator provides and tap Continue.

   The app retrieves the list of projects you are authorized to access and displays them for selection. If the project you want is not listed, contact your administrator. If you have only one project, the app displays the project entry screen.

3. The agent will connect based on the connect method configured by your Prisma Agent administrator. The Prisma Agent supports the following connect methods:

   • Always-On
     In an Always-On configuration, Prisma Agent automatically connects as soon as end users log in. You can optionally enable Lockdown Mode to enforce all network traffic through the Prisma Agent and block traffic that does not go through the Prisma Agent.
   • On-Demand
     In an on-demand configuration, end users must manually connect Prisma Agent through the application. Traffic is routed through the Prisma Agent app only after the end users initiate and establish the connection.
   • Per-App
     In a per-app configuration, you can specify the managed apps that can route traffic through Prisma Agent when connected. If using an allowlist, only the specified apps will be routed through Prisma Agent. If using a blocklist, all traffic will be routed through Prisma Agent except for the specified apps.

   After a first-time installation, the Prisma Agent does not automatically connect to Prisma Access, even if your administrator configured Always On mode. You must log in to complete your initial enrollment, which includes entering the project name your administrator provides.

   After this first login, Always On mode takes effect and the agent connects automatically on subsequent logins.

   If you're unable to connect and need to share logs with your IT administrator, tap ? in the top-right corner of the enrollment page. This opens a share sheet with a log archive that you can share via Gmail, Messages, Nearby Share, or other apps.

4. If your agent is always-on, you'll receive a notification to authenticate with your identity provider.

   Your administrator controls which notifications you receive. You can view and manage your notification settings in Notification Controls.

   1. Tap the notification to proceed.
   2. Enter your organization credentials to authenticate to the app:

      (Prisma Agent 26.3) If your administrator configured Prisma Agent to use the default system browser for SAML authentication, the default browser, such as Chrome, opens instead of the embedded browser. After you authenticate, tap Open Prisma Access Agent in the prompt that appears to return to the Prisma Agent app.

5. If your agent is on-demand, manually connect to the agent.

   1. Connect by clicking the lock icon.

   2. Enter your organization credentials to authenticate to the app:

      If your administrator configured Prisma Agent to use the default system browser for SAML authentication, the default browser, such as Chrome, opens instead of the embedded browser. After you authenticate, tap Open Prisma Access Agent in the prompt that appears to return to the Prisma Agent app.

6. After authentication is complete, the connection is established and the app displays the status as Connected.

7. For Prisma Agents agents with on-demand or per-app configurations, tap Disconnect on the app when you no longer need to access resources through the Prisma Agent.

   For Prisma Agents with always-on configurations, you won't be able to disconnect the agent due to your organization's IT policy.