>
    Strata Copilot
    Configure Applications for Privileged Remote Access
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access
    3. Prisma Access Administration
    4. Privileged Remote Access
    5. Configure Applications for Privileged Remote Access
    Download PDF
    Prisma Access

    Configure Applications for Privileged Remote Access

    Table of Contents

    Configure Applications for Privileged Remote Access

    Add the apps that your users will access remotely from the Privileged Remote Access portal.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Panorama or Strata Cloud Manager)
    • Prisma Access 5.2.1
    • Minimum Prisma Access dataplane version: 11.2.4
    • Prisma Access license with a Mobile User subscription
    • Privileged Remote Access add-on license
    After you set up the Privileged Remote Access (PRA) portal, you can add the apps that your users will access from the PRA portal. You can add apps that users can access using the RDP, SSH, or VNC protocol. For example, you can set up a PRA app for the remote access of a Windows desktop using RDP, or to remotely log in to a computer using SSH
    After adding applications, you can set up application groups to help manage which users can access which groups of apps.
    Before you can add the applications that your users will access from the PRA portal, you will need the following information about the apps:
    • The type of protocol that your users will use to access the app
    • The FQDN or IP address of the app destination
    • The port number used to reach the app (if different from the default port)
    • Login credentials for the app on the target machine (optional)
    To resolve the internal hostnames of applications deployed in your data center, you need to have an active Service Connection to the data center and firewall rules to access your internal DNS server.
    Learn how to the add following types of remote applications to the PRA portal.

    Configure RDP Applications for Privileged Remote Access

    Add the RDP apps that your users will access remotely from the Privileged Remote Access portal.
    To add the RDP apps that your users will remotely access from your PRA portal:
    1. Navigate to the PRA Applications page.
      • For Prisma Access (Managed by Strata Cloud Manager):
        1. Log in to Strata Cloud Manager as the administrator.
        2. Select ConfigurationPrivileged Remote AccessApplications.
      • For Prisma Access (Managed by Panorama):
        1. Launch Privileged Remote Access from the Cloud Services plugin on Panorama by selecting PanoramaCloud ServicesPrivileged Remote Access.
        2. Click Get Started.
        3. Select ConfigurationPrivileged Remote AccessApplications.
    2. Click ApplicationsAdd Application.
    3. Configure general settings for the app.
      1. Select App TypeRDP.
      2. Enter a Name for the app.
      3. (Optional) Select a Keyboard Layout to use for the remote RDP app.
      4. (Optional) Enter a description for the app.
      5. Enter the Destination FQDN or IP address of the app. The FQDN or IP address must be reachable using a Service Connection in your Prisma Access tenant.
      6. Enter the Port to use for the app, if different from the default port.
        You can enter only one port between 1-65535. (Default: 3389)
    4. Configure additional settings for the RDP.
      1. (Optional) Enter the User Name and Password for the remote app, and confirm the password. The username and password are optional, but you must enter both settings or leave both blank.
      2. Select the Security Mode for the app, which determines the authentication and encryption method for the RDP connection.
        • NLA (Network Level Authentication)—(Recommended) This is the default and highest security option. With NLA, users must authenticate with valid credentials before establishing a full remote desktop session. This preauthentication process (CredSSP) helps protect server resources by validating user identity first, before consuming significant memory or processing power.
          Best for: Standard direct RDP connections where you need maximum security.
        • TLS Encryption—This mode uses Transport Layer Security to encrypt the connection, but authentication happens after connection establishment at the Windows login screen rather than beforehand.
          Best for: Specialized network setups including RDP Gateway connections or load-balanced server farms where the initial connection might be redirected to different target servers.
      3. (Optional) Enable Legacy Windows Mode if you experience display issues when connecting to older Windows systems.
        Some older Windows operating systems, such as Windows 7, might experience display problems due to incorrect color depth negotiation. These systems usually support 16-bit color but can fail when attempting to fall back to 8-bit color, which can result in corrupted display or connection failures. When enabled, this mode uses a color depth negotiation method designed for compatibility with these older systems.
    5. Save your settings. The application is added to the Applications table. You can visit this page later to add, edit, or remove an app.

    Configure SSH Applications for Privileged Remote Access

    Add the SSH apps that your users will access remotely from the Privileged Remote Access portal.
    To add the SSH apps that your users will remotely access from your PRA portal:
    1. Navigate to the PRA Applications page.
      • For Prisma Access (Managed by Strata Cloud Manager):
        1. Log in to Strata Cloud Manager as the administrator.
        2. Select ConfigurationPrivileged Remote AccessApplications.
      • For Prisma Access (Managed by Panorama):
        1. Launch Privileged Remote Access from the Cloud Services plugin on Panorama by selecting PanoramaCloud ServicesPrivileged Remote Access.
        2. Click Get Started.
        3. Select ConfigurationPrivileged Remote AccessApplications.
    2. Click ApplicationsAdd Application.
    3. Configure general settings for the app.
      1. Select App TypeSSH.
      2. Enter a Name for the app.
      3. (Optional) Enter a description for the app.
      4. Enter the Destination FQDN or IP address of the app. The FQDN or IP address must be reachable using a Service Connection in your Prisma Access tenant.
      5. Enter the Port to use for the app, if different from the default port.
        You can enter only one port between 1-65535. (Default: 22)
    4. (Optional) Configure authentication settings for the app.
      1. Enter the User Name and Password for the remote app, and confirm the password. If you enter a username and don't enter a password, you must provide a private key.
      2. (Optional) Enter the Private Key for the app. If the private key is encrypted, enter your passphrase.
      3. (Optional) Enter the Passphrase for the app.
      4. (Optional) Enter the Host Key entries for the remote host, which you can obtain by running the ssh-keyscan command on the host. Enter one key per line. Lines that begin with # are treated as comments.
    5. Save your settings. The application is added to the Applications table. You can visit this page later to add, edit, or remove an app.

    Configure VNC Applications for Privileged Remote Access

    Add the VNC apps that your users will access remotely from the Privileged Remote Access portal.
    To add the VNC apps that your users will remotely access from your PRA portal:
    1. Navigate to the PRA Applications page.
      • For Prisma Access (Managed by Strata Cloud Manager):
        1. Log in to Strata Cloud Manager as the administrator.
        2. Select ConfigurationPrivileged Remote AccessApplications.
      • For Prisma Access (Managed by Panorama):
        1. Launch Privileged Remote Access from the Cloud Services plugin on Panorama by selecting PanoramaCloud ServicesPrivileged Remote Access.
        2. Click Get Started.
        3. Select ConfigurationPrivileged Remote AccessApplications.
    2. Click ApplicationsAdd Application.
    3. Configure general settings for the app.
      1. Select App TypeVNC.
      2. Enter a Name for the app.
      3. (Optional) Enter a description for the app.
      4. Enter the Destination FQDN or IP address of the app. The FQDN or IP address must be reachable using a Service Connection in your Prisma Access tenant.
      5. Enter the Port for the destination, if different from the default port.
        You can enter only one port between 1-65535. (Default: 5900)
    4. (Optional) Configure additional settings for the app.
      1. (Optional) Enter the User Name and Password for the remote app, and confirm the password. The username and password are optional, but you must enter both settings or leave both blank.
      2. Enable File Transfer to allow your users to upload and download files using SFTP (SSH File Transfer Protocol).
    5. If you enabled file transfer in the previous step, configure the file transfer settings.
      1. Enter your SFTP Username and SFTP Password. If you don't provide a password, you must provide the SFTP private key.
      2. The SFTP Hostname is automatically populated with the Destination FQDN or IP address. No entry is required.
      3. Enter the SFTP Port to use for file transfers. You can enter only one port between 1-65535. (Default: 22)
      4. Enter the SFTP Private Key. This is required if you don't enter an SFTP password.
      5. (Optional) Enter the SFTP Passphrase. This is required if the SFTP private key is encrypted.
      6. (Optional) Enter the SFTP Host Key.
    6. Save your settings. The application is added to the Applications table. You can visit this page later to add, edit, or remove an app.

    © 2025 Palo Alto Networks, Inc. All rights reserved.