Prisma Access
Add Azure Active Directory
Table of Contents
Expand All
|
Collapse All
Prisma Access Docs
-
- Prisma Access China
- 4.0 & Later
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
-
-
-
- 5.2 Preferred and Innovation
- 5.1 Preferred and Innovation
- 5.0 Preferred and Innovation
- 4.2 Preferred
- 4.1 Preferred
- 4.0 Preferred
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
Add Azure Active Directory
Where Can I Use
This? | What Do I Need? |
---|---|
|
|
Add an Azure Active Directory (Azure AD) in the Cloud Identity Engine to allow the
Cloud Identity Engine to collect data from your Azure AD for policy enforcement and
user visibility.
Before you begin, set up your Azure Active Directory in your Microsoft Azure
account.
To add an Azure AD in the Cloud Identity Engine, you must have at least the
following role privileges in Azure AD: Application Administrator and Cloud
Application Administrator. For more information about roles in Azure AD, refer
to the following link. You must have an administrative
account for the directory to grant the following required permissions.
- Access Azure Service Management
- View your basic profile
- Maintain access to data for which you have given it access
- Read directory data
- View your email address
- From Prisma Access, open the Cloud Identity Engine app associated with your tenant.
- Go to.Prisma AccessTenants and ServicesCloud Identity Engine
- In the Cloud Identity Engine app, select.DirectoriesAdd New Directory
- Set UpaCloud Directory, and selectAzure.
- Sync your directory with Azure AD.
- Connect to Azure AD using the authentication code flow or the client credential flow.This example uses the authentication code to log in to Azure AD. Using the client credential flow requires you to configure your Azure AD with necessary permissions, so ensure you have completed all of the pre-deployment steps necessary to Deploy Client Credential Flow for Azure Active Directory.
- Sign in with Azure.
- Enter credentials to sign in,Consent on behalf of your organizationto grant the permissions that the Cloud Identity Engine requires to get the metadata with the list of directories andAcceptto confirm.
- Test Connectionto confirm that the Cloud Identity Engine instance can successfully communicate with the Azure directory.The Cloud Identity Engine checks for the primary directory. While the test is in progress, the button displaysTesting. When the Cloud Identity Engine verifies the connection, the button displaysSuccessand lists the domain name and ID for the directory. If the connection is not successful, the button displaysFailedand a red exclamation point. If this occurs, confirm you have entered your Azure credentials correctly. If you have more than one directory in your Azure AD, select the radio button for each directory andTest Connection.Submiteach directory individually.
- Customize Directory Nameto enter a different name for the directory.If you are collecting data for the same domain from both an on-premises Active Directory (AD) and an Azure AD, Palo Alto Networks recommends that you create a separate Cloud Identity Engine instance for each directory type. If you must use the same Cloud Identity Engine instance and want to collect data from both an on-premises AD and an Azure AD, you must customize the directory name for the Azure AD (for example, by adding .aad to Customize Directory Name) then Reconnect Azure Active Directory. Any applications that you associate with the Cloud Identity Engine use the custom directory name.
- The custom directory name is the alias for your Azure AD in your Cloud Identity Engine instance; it does not change the name on your directory. If you do not enter a custom directory name, the Cloud Identity Engine uses the default domain name.
- The Cloud Identity Engine supports lowercase alphanumeric characters, periods (.), hyphens (-), and underscores (_).
- If you associate the Cloud Identity Engine with Cortex XDR, the customized directory name must be identical to theDomainyou select in Cortex XDR.The custom directory name must match the corresponding directory name in any app that you associate with the Cloud Identity Engine. For example, if you are using the Cloud Identity Engine with Cortex XDR, the custom directory name in the Cloud Identity Engine must be the same as the directory name in Cortex XDR.
- Submitthe configuration changes.When you submit the configuration, the Cloud Identity Engine connects to your Azure AD and begins synchronizing attributes. TheSync Statuscolumn displaysIn Progresswhile the Cloud Identity Engine collects the attributes.