Account Protection for the Prisma Browser for iOS
Prisma Browser for iOS now supports Account Protection, extending
browser-level credential salting to mobile devices and bringing iOS to parity with
desktop.
Account Protection locks enterprise accounts to Prisma Browser by salting
credentials at the browser level. When a protected account is accessed through Prisma Browser, a secret element is added to the password before it reaches the
website. The credential only works inside Prisma Browser — it cannot be reused from
Chrome, Safari, or any other browser. If a user is off-boarded, they lose access
instantly without requiring a password reset.
How It Works on iOS?
Account Protection on iOS uses the same credential salting mechanism as desktop:
- Shared Salt Implementation — The same password salting mechanism from
desktop is available on iOS. Credentials are transformed before submission and
stored securely in the iOS Keychain, ensuring accounts are locked to
Prisma Browser.
- Plugin-based JavaScript Integration — Injected JavaScript intercepts
password fields on protected applications, transparently salting credentials
during login so the website only ever receives the protected version.
- Built-in Password Manager Adjustment — Account Protection works
seamlessly alongside the browser's built-in password manager. Protected
credentials flow correctly through auto-fill while maintaining the salting
mechanism.
- User-facing Indicator and Popup — A visual indicator shows users when
Account Protection is active on an application, with an explanatory popup
guiding them through the enrollment process.
Key Use Cases
- Enterprise teams accessing deal sites, shared financial portals, and sensitive
applications from iOS devices — accounts are locked to Prisma Browser and
cannot be accessed from personal browsers.
- Shared account scenarios where multiple users access a single set of
credentials — even if a user memorizes the password, it will not work outside
Prisma Browser.
- Secure off-boarding — when employees or contractors are removed from Prisma Browser, they immediately lose access to all protected accounts with
no password reset required.
Limitations
Account Protection on iOS supports accessing
applications that are already protected, but the initial password enrollment
(creating the salted password) must still be performed on desktop. New users must
enroll their account on Prisma Browser desktop first using the reset password
flow, and can then seamlessly access the protected application from iOS.
Prerequisites
- Prisma Browser for iOS version 26.06.00 or later.
- Account Protection must be configured for the target application in the
Prisma Browser administration console.
- The user must have already enrolled their credentials on
Prisma Browser desktop (using the reset password flow).
