Configure the Agent to Use the Default System Browser for SAML Authentication (Windows and macOS)

1. Configure the Prisma Agent to use the default system browser using one of the following methods.

   • Use preconfiguration by installing the agent with the configuration file (config.json) that defines the intended browser type. To enable the system browser for SAML authentication, include the following key in config.json:

     "use_external_browser_for_auth": true

     The default is to use the embedded browser for SAML authentication.
   • (Strata Cloud Manager Managed Prisma Access only) Configure the Prisma Agent settings. The settings are applied per user or user group and take precedence over the config.json settings.
     1. Navigate to the Prisma Agent tab.
        1. Log in to Strata Cloud Manager as the administrator.
        2. Select ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess AgentSetupPrisma Access Agent.
     2. Configure user authentication settings if needed for the user or user group for which you want to enable the default system browser.
     3. Add an agent setting or edit an existing agent setting.
     4. Select the criteria (OS or User Entities) that match the user or user group for which you want to enable the default system browser.

     5. Enable the option to use the default system browser for authentication.
        Select Show Advanced OptionsAuthentication and enable Use External Browser for Authentication. The default is unchecked (use the embedded browser).

     6. Configure other agent settings if needed and Save the settings.
     7. Push the configuration by selecting Push ConfigPush.
   • Configure browser type settings using the pacli command. To set the system browser for SAML authentication, use the following command on the endpoint:

     pacli browser system

     The pacli setting takes the highest precedence on browser selection. The default is to use the embedded browser for SAML authentication (pacli browser internal).

   You can use any of these methods, but the last setting overrides all other settings. Performing a configuration push on Strata Cloud Manager overrides the PACli command as well.
2. (Optional) To verify and troubleshoot the browser configuration.

   1. Check the current browser setting by running the following command on the endpoint:

      pacli browser

   2. Check the agent logs for browser-related activities. Browser-related logs are written to the following files on the endpoint.

      On Windows:

      %ProgramData%\Palo Alto Networks\Prisma Access Agent\Logs\PABrowser.log

      On macOS:

      ~/Library/Logs/PaloAltoNetworks/Prisma Access Agent/PABrowser.log