>
    Strata Copilot
    Configure Mobile Notification Controls
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Agent
    3. Configure the Prisma Agent
    4. Configure Mobile Notification Controls
    Download PDF
    Prisma Agent

    Configure Mobile Notification Controls

    Table of Contents

    Configure Mobile Notification Controls

    Control which background notifications the Prisma Agent sends on iOS and Android devices by using Strata Cloud Manager or your MDM solution.
    Where Can I Use This?What Do I Need?
    • Strata Cloud Manager Managed Prisma Access (for unmanaged devices)
    • MDM solution, such as Microsoft Intune (for managed devices)
    • iOS or Android devices
    • Prisma Agent 26.4 or later (managed devices)
    • Prisma Agent 26.4.3 or later (unmanaged devices)
    • Managed device enrollment (managed devices)
    Mobile notification controls let you tailor the Prisma® Agent notification experience to match your organization's operational needs. Different deployment scenarios call for different notification strategies: some organizations want full visibility across all categories, while others prefer to limit interruptions for users who connect automatically in the background. Rather than applying a single all-or-nothing setting, you can configure each notification category independently. Each category can be set to active, suppressed, or user-adjustable, so you preserve the alerts that require user action while reducing the ones that don't.
    Where you configure notification controls depends on whether the device is managed. For managed devices, you deploy custom keys through your mobile device management (MDM) solution. For unmanaged devices, you configure the controls in Strata Cloud Manager, and the Prisma Agent applies them when the device connects to your tenant.
    The Prisma Agent organizes mobile notifications into three configurable categories:
    • Connection Failure — alerts users when the agent cannot establish or maintain a connection
    • User Sign-in is required — covers events that require user intervention, including SAML and LDAP authentication prompts, certificate selection, and captive portal prompts (iOS only)
    • Session Extension — informs users when their session is nearing expiration and gives them the opportunity to extend it before they are disconnected
    For each category, you set one of three values. In an MDM profile, you enter the value as shown. In Strata Cloud Manager, you choose Enable, Disable, or User-Controlled.
    • enabled — the notification is active and users cannot toggle it
    • disabled — the notification is hidden from users entirely
    • user_controlled — the notification is on by default, and users can toggle it off in the Notification Controls section of the Prisma Agent app
    Any category you do not configure defaults to enabled. The Prisma Agent reads the MDM configuration on every new connection.
    If a device is managed, the MDM configuration always takes precedence and the Prisma Agent ignores the Strata Cloud Manager settings. This applies even when you leave a category unset in the MDM profile, in which case that category is enabled. If you remove the device from management, the agent applies the Strata Cloud Manager configuration the next time the device connects. Tenants that don't support notification controls leave all notifications enabled.
    On unmanaged devices, users can change the server address in the app on iOS or Android. When they do, the Prisma Agent clears their notification preferences and applies the configuration from the new server. Logging out and reconnecting keeps their preferences.
    Notification controls apply to background notifications only. When the Prisma Agent app is in the foreground, all notification types are displayed regardless of your configuration. HIP notifications are always enabled and are not subject to these controls. On Android, two notifications cannot be suppressed due to OS VPN compliance requirements: the alert that the VPN service started, and the notification to restart the app when the app container is killed.

    Configure Mobile Notification Controls (Strata Cloud Manager)

    Configure notification controls in Strata Cloud Manager to control which background notifications the Prisma Agent sends on unmanaged iOS and Android devices.
    For unmanaged devices, you set the notification controls in the app settings of an agent settings profile. The Prisma Agent applies the settings when the device connects to your tenant. Managed devices ignore these settings because the MDM configuration takes precedence.
    1. In Strata Cloud Manager, go to Access Agent Setup by selecting ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess AgentSetupPrisma Access Agent.
    2. Click Add Agent Settings, or select an existing agent settings profile to update.
    3. Expand Show Advanced Options, and then expand Notification below Authentication and Anti-Tamper.
    4. In the Agent Notification Controls (iOS & Android only) section, choose an option for each notification category.
      • Connection failure notification
      • User action notification
      • Session extension notification
      For each category, choose one of the following options:
      • Enable—The notification is active and users cannot turn it off.
      • Disable—The notification is hidden from users.
      • User-Controlled—The notification is on by default, and users can turn it off in the Notification Controls section of the app.
    5. Click Save.
    6. Select Push ConfigPush, select Admin ScopeAll Admins, enter a Description, and Push the configuration.
      The Prisma Agent applies the settings the next time an unmanaged iOS or Android device connects.

    Configure Mobile Notification Controls (MDM)

    Deploy custom keys in your MDM profile to control which background notifications the Prisma Agent sends on managed iOS and Android devices.
    For managed devices, you set the notification controls in the VPN or app configuration profile that you deploy through your MDM solution. The MDM configuration takes precedence over any Strata Cloud Manager settings.
    1. In your MDM solution, open the VPN or app configuration profile for the Prisma Agent.
    2. Add the custom configuration keys for each notification category you want to control:
      KeyValuesDefault
      notification_connection_failureenabled | disabled | user_controlledenabled
      notification_user_actionenabled | disabled | user_controlledenabled
      notification_session_extensionenabled | disabled | user_controlledenabled
      Any incorrect key or key you omit defaults to enabled.
      1. (iOS) In the VPN settings of your Microsoft Intune device profile, add the notification control keys to the key and value pairs for the custom VPN attributes.
        Your device profile also needs the other required VPN settings for iOS endpoints.
      2. (Android) In your Microsoft Intune app configuration policy, use the configuration designer to set a value for each notification category.
        The configuration designer lists the categories by name: Connection Failures (notification_connection_failure), Action Required (notification_user_action), and Session & Timeout (notification_session_extension).
        Your app configuration also needs the other required settings for Android endpoints.
    3. Deploy the updated profile to the target managed devices.
      On the next connection, the Prisma Agent reads the MDM configuration and applies the notification settings. Users can view and manage their settings in Notification Controls (iOS) or Notification Controls (Android).

    © 2026 Palo Alto Networks, Inc. All rights reserved.