>
    Strata Copilot
    Switch Between the Prisma Agent and GlobalProtect App
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Agent
    3. Prisma Agent for Desktop Devices
    4. Switch Between the Prisma Agent and GlobalProtect App
    Download PDF
    Prisma Agent

    Switch Between the Prisma Agent and GlobalProtect App

    Table of Contents

    Switch Between the Prisma Agent and GlobalProtect App

    You can use either the Prisma Agent app or the Prisma Access command-line tool (PACli) to switch between the Prisma Agent and the Global Protect app.
    Where Can I Use This?What Do I Need?
    • Prisma Agent
    • macOS 14 and later or Windows 10 version 2024 and later desktop devices
    • Internet access
    In some organizations, the Prisma Agent is installed on user devices that already have the GlobalProtect app installed. After installing the Prisma Agent, you can switch between the Prisma Agent and the GlobalProtect app as needed.
    Before switching to the GlobalProtect app, you must disable the Prisma Agent app. The following table shows the Prisma Agent behavior after disabling the agent and after switching to GlobalProtect.
    Prisma Agent BehaviorAfter Disabling Prisma AgentAfter Switching to GlobalProtect
    Connectivity to the tunnelNoNo
    Connectivity to the server (Endpoint Manager)YesYes
    Prisma Agent NotificationsNoNo
    Prisma Agent enforcerNoNo, but GlobalProtect enforcer is enabled
    ADEM Access Experience statusYes (independent of agent status)Yes (independent of agent status)
    Troubleshooting by remote shellYesYes
    Anti-tamper featureYesYes
    PACli commands functionalYes, but don't use pacli connectYes, but don't use pacli connect
    You can use either the Prisma Agent app or the Prisma Access command-line tool (PACli) to switch between the two apps. (Not supported on Prisma Agent Linux)

    Switch Between the Prisma Agent and GlobalProtect App (Using Prisma Agent App)

    Learn how to switch between the Prisma Agent and the Global Protect app using the Prisma Agent App.
    Before switching to the GlobalProtect™ app, you need to disable the Prisma Agent. If your administrator configured the feature to allow users to disable the Prisma Agent, you can use the app to disable the Prisma Agent. After you disable the Prisma Agent, you can start the GlobalProtect app.
    Your administrator must contact the Palo Alto Networks team to enable this tenant-level feature. It's not available as an agent setting on Strata Cloud Manager.
    • To switch from the Prisma Agent to the GlobalProtect app:
      1. Open the Prisma Agent.
        If you're disabling the agent for the first time, open the Prisma Agent app and sign out of the Prisma Agent.
        1. Select the hamburger menu and select Sign Out.
        2. Log in to the Prisma Agent app again to make the Disable link appear in the preferences window.
      2. Click the hamburger menu to open the preferences window.
      3. Disable the Prisma Agent.
      4. Close the preferences window by clicking the X.
        The Prisma Agent is disabled.
      5. Start the GlobalProtect app and Connect to GlobalProtect.
    • To switch from the GlobalProtect app back to the Prisma Agent:
      1. Open the GlobalProtect app.
      2. Click the options menu and select Disconnect.
      3. Launch the Prisma Agent app.
      4. Click the hamburger menu to open the preferences window.
      5. Enable the Prisma Agent.
      6. Close the preferences window by clicking the X.
      7. If the agent is in Always On mode, the agent is enabled and will connect to the best location.
        If the agent is in On-Demand mode, the Prisma Agent is enabled but remains disconnected. Click the lock icon to connect to the Prisma Access location.

    Switch Between the Prisma Agent and GlobalProtect App (Using PACli)

    Learn how to switch between the Prisma Agent and the Global Protect app using the command line.
    To switch between the Prisma Agent and the GlobalProtect app, run the Prisma Access command-line tool (PACli). When switching to the GlobalProtect app, the PACli tool will prompt you for the anti-tamper unlock password if the administrator set one up during the onboarding of the Prisma Agent. Switching to the desired app disables the app that you're currently using.
    1. To switch from the Prisma Agent to the GlobalProtect app:
      1. Run the switchto command to switch agents:
        • On macOS devices, open a Terminal window and issue the following command:
          sudo /Applications/Prisma\ Access\ Agent.app/Contents/Helpers/pacli switchto GlobalProtect
        • On Windows devices, open a Command Prompt window and issue the following command:
          "C:\Program Files\Palo Alto Networks\Prisma Agent\pacli" switchto GlobalProtect
      2. (macOS) Enter the admin password when prompted.
      3. If prompted, enter Y to switch to the GlobalProtect app.
      4. If prompted for a supervisor password, enter the anti-tamper unlock password.
        The following text shows an example of switching from the Prisma Agent to GlobalProtect on a macOS device:
        <username@hostname> ~ % cd /Applications/Prisma\ Access\ Agent.app/Contents/Helpers
<username@hostname> Helpers % sudo ./pacli switchto GlobalProtect  
Enter supervisor password:
Disabled Prisma Access Agent.
Starting the GlobalProtect service. This can take up to 60 seconds...
Successfuly started GlobalProtect. Switch complete.
<username@hostname> Helpers %
        This action stops the Prisma Agent service, and starts the GlobalProtect service. An entry is written to the Prisma Agent logs indicating that the Prisma Agent has been disabled. For example, the following events are logged:
        <username@hostname> ~ % cd /Applications/Prisma\ Access\ Agent.app/Contents/Helpers
<username@hostname> Helpers % ./pacli event
.
.
740      2024-12-11 23:20:57  Tamper Detection   Agent is disabled
741      2024-12-11 23:20:57  Agent Tunnel       Tunnel disconnected
.
.
      5. (Optional) Show the status of the switchto command by running the pacli switchto status command.
        The following text shows an example of checking the status of the switchto command on macOS:
        <username@hostname> ~ % cd /Applications/Prisma\ Access\ Agent.app/Contents/Helpers
<username@hostname> Helpers % sudo ./pacli switchto status
Prisma Access Agent:      Disabled
GlobalProtect:            Enabled
<username@hostname> Helpers %
    2. To switch back to the Prisma Agent:
      1. Run the switchto command to switch agents:
        • On macOS devices, open a Terminal window and issue the following command:
          sudo /Applications/Prisma\ Access\ Agent.app/Contents/Helpers/pacli switchto PrismaAccessAgent
        • On Windows devices, open a Command Prompt window and issue the following command:
          "C:\Program Files\Palo Alto Networks\Prisma Access Agent\pacli" switchto PrismaAccessAgent
      2. (macOS) Enter the admin password when prompted.
      3. If prompted, enter Y to switch to the Prisma Agent.
      4. If prompted for a supervisor password, enter the anti-tamper unlock password.
        The following text shows an example of switching from the GlobalProtect app to the Prisma Agent on a macOS device:
        <username@hostname> ~ % cd /Applications/Prisma\ Access\ Agent.app/Contents/Helpers
<username@hostname> Helpers % sudo ./pacli switchto PrismaAccessAgent
Password:
Enter supervisor password:
Stopping the GlobalProtect service. This can take up to 60 seconds...
Disabled GlobalProtect.
Successfuly started Prisma Access Agent. Switch complete.
<username@hostname> Helpers %
        This action stops the GlobalProtect service and starts the Prisma Agent service. An entry is written to the Prisma Agent logs indicating that the Prisma Agent has been enabled. For example, the following events are logged:
        <username@hostname> ~ % cd /Applications/Prisma\ Access\ Agent.app/Contents/Helpers
<username@hostname> Helpers % ./pacli event
.
.
742      2024-12-11 23:21:05  Tamper Detection   Agent is enabled
743      2024-12-11 23:21:21  Agent Tunnel       Tunnel connected
.
.
        After switching back to the Prisma Agent, if the agent is in Always On mode, the agent will be enabled and will connect to the best location. If the agent is in On-Demand mode, the agent will be enabled but disconnected.
      5. (Optional) Show the status of the switchto command by running the pacli switchto status command.
        The following text shows an example of checking the status of the switchto command on macOS:
        <username@hostname> ~ % cd /Applications/Prisma\ Access\ Agent.app/Contents/Helpers
<username@hostname> Helpers % sudo ./pacli switchto status
Prisma Access Agent:      Enabled
GlobalProtect:            Disabled
<username@hostname> Helpers %

    © 2026 Palo Alto Networks, Inc. All rights reserved.