>
    Strata Copilot
    Configure Prisma Agent to Use the Default System Browser for SAML Authentication
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Agent
    3. Configure the Prisma Agent
    4. Set Up Prisma Agent User Authentication
    5. Set Up SAML Authentication With Cloud Identity Engine
    6. Prisma Agent Embedded Browser for SAML Authentication
    7. Configure Prisma Agent to Use the Default System Browser for SAML Authentication
    Download PDF
    Prisma Agent

    Configure Prisma Agent to Use the Default System Browser for SAML Authentication

    Table of Contents

    Configure Prisma Agent to Use the Default System Browser for SAML Authentication

    Learn how to configure the Prisma Agent to use the default system browser for SAML authentication.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Panorama or Strata Cloud Manager)
    • NGFW (Managed by Panorama)
    • Check the prerequisites for the deployment you're using
    • macOS or Windows endpoints (Prisma Agent 25.3)
    • iOS endpoints (Prisma Agent 26.3)
    • Contact your Palo Alto Networks account representative to activate the Prisma Agent feature
    If you configure the Prisma Agent to authenticate users via SAML authentication, the agent will by default use the Prisma Agent embedded browser for SAML authentication. If you don't want to use the embedded browser for SAML authentication, you can configure the agent to use the endpoint's default system browser, such as Chrome, Firefox, or Safari.
    In addition, on any browser that supports the Web Authentication (WebAuthn) API, you can use Universal 2nd Factor (U2F) security tokens such as YubiKeys for multi-factor authentication (MFA) to identify providers (IdPs) such as Azure or Okta.
    If you use the default system browser for SAML authentication, the browser tab remains open upon successful authentication. If the user does not close the browser tab each time after authentication, multiple browser tabs can remain open.

    Configure the Agent to Use the Default System Browser for SAML Authentication (Windows and macOS)

    Configure Prisma Agent to use the default system browser for SAML authentication on Windows and macOS endpoints.
    With the default system browser, end users can connect to the Prisma Agent or other SAML-enabled applications without having to reenter their credentials for a seamless single sign-on (SSO) experience. End users benefit from using the default system browser for SAML authentication because they can use the same login for Prisma Agent with their saved user credentials on the default system browser.
    You can configure the default system browser through predeployment using the configuration file (config.json), user-specific configurations on Strata Cloud Manager, or local overrides using the pacli command.
    1. Configure the Prisma Agent to use the default system browser using one of the following methods.
      • Use preconfiguration by installing the agent with the configuration file (config.json) that defines the intended browser type. To enable the system browser for SAML authentication, include the following key in config.json:
        "use_external_browser_for_auth": true
        The default is to use the embedded browser for SAML authentication.
      • (Strata Cloud Manager Managed Prisma Access only) Configure the Prisma Agent settings. The settings are applied per user or user group and take precedence over the config.json settings.
        1. Navigate to the Prisma Agent tab.
          1. Log in to Strata Cloud Manager as the administrator.
          2. Select ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess AgentSetupPrisma Access Agent.
        2. Configure user authentication settings if needed for the user or user group for which you want to enable the default system browser.
        3. Add an agent setting or edit an existing agent setting.
        4. Select the criteria (OS or User Entities) that match the user or user group for which you want to enable the default system browser.
        5. Enable the option to use the default system browser for authentication.
          Select Show Advanced OptionsAuthentication and enable Use External Browser for Authentication. The default is unchecked (use the embedded browser).
        6. Configure other agent settings if needed and Save the settings.
        7. Push the configuration by selecting Push ConfigPush.
      • Configure browser type settings using the pacli command. To set the system browser for SAML authentication, use the following command on the endpoint:
        pacli browser system
        The pacli setting takes the highest precedence on browser selection. The default is to use the embedded browser for SAML authentication (pacli browser internal).
      You can use any of these methods, but the last setting overrides all other settings. Performing a configuration push on Strata Cloud Manager overrides the PACli command as well.
    2. (Optional) To verify and troubleshoot the browser configuration.
      1. Check the current browser setting by running the following command on the endpoint:
        pacli browser
      2. Check the agent logs for browser-related activities. Browser-related logs are written to the following files on the endpoint.
        On Windows:
        %ProgramData%\Palo Alto Networks\Prisma Access Agent\Logs\PABrowser.log
        On macOS:
        ~/Library/Logs/PaloAltoNetworks/Prisma Access Agent/PABrowser.log

    Configure the Agent to Use the Default System Browser for SAML Authentication (iOS)

    Configure Prisma Agent to use the default system browser for SAML authentication on iOS endpoints using MDM software or Strata Cloud Manager.
    On iOS endpoints, you configure the default system browser for SAML authentication through MDM software before enrollment, or through Strata Cloud Manager agent settings after enrollment.
    1. Configure the default system browser using one of the following methods.
      • MDM software (before enrollment). Push the following key-value pair to your iOS devices using your MDM software:
        use_external_browser_for_auth: true
        When the MDM key is present, Prisma Agent uses the default browser from the first login. When the MDM key is not present, Prisma Agent uses the embedded browser for the initial enrollment. After enrollment, the Strata Cloud Manager agent setting takes effect on subsequent logins.
      • (Strata Cloud Manager only) Strata Cloud Manager agent settings (after enrollment). Follow the Strata Cloud Manager agent settings steps in Windows and macOS. The default system browser takes effect after the agent receives the configuration on subsequent logins.
      If you use the default system browser for SAML authentication, browser tabs accumulate if not closed after authentication.

    © 2026 Palo Alto Networks, Inc. All rights reserved.