>
    Strata Copilot
    Use External Dynamic Lists in Policy Rules
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. Manage Prisma Browser Policy Rules
    4. Manage Prisma Browser Access and Data Control Rules
    5. Use External Dynamic Lists in Policy Rules
    Download PDF
    Prisma Browser

    Use External Dynamic Lists in Policy Rules

    Table of Contents

    Use External Dynamic Lists in Policy Rules

    Reference external dynamic lists of domains in Prisma Browser Access and Data Control rules so that policy stays current as the lists change at their source.
    Where Can I Use This?What Do I Need?
    • Strata Cloud Manager
    • Prisma Browser standalone
    • Prisma Access with Prisma Browser bundle license or Prisma Browser standalone license
    • Superuser or Prisma Browser role
    • External dynamic lists configured in Strata Cloud Manager
    • Early Access enablement for your tenant
    External dynamic list support in Prisma Browser policy rules is available as an Early Access feature. Functionality and supported list types may change before general availability. To enable the feature for your tenant, contact your Palo Alto Networks account team.
    External Dynamic Lists (EDLs) allow Access and Data Control rules to reference a named list of domains that is maintained outside of the rule. When the list changes at its source, the Prisma Browser picks up the change automatically, without manual edits to the rule. EDLs are managed in Strata Cloud Manager and are read-only in the Prisma Browser. The same EDL object that drives network security policy can be referenced in Prisma Browser policy rules, so a single list is defined once and enforced in both places.
    Use EDLs to:
    • Enforce large allow lists, block lists, and threat feeds that exceed custom application URL limits.
    • Keep browser policy current with frequently updated lists without editing rules.
    • Reuse existing firewall and Prisma Access EDLs in browser policy.
    For more information on creating EDLs, see External Dynamic List.

    External Dynamic List Hosting Models

    The Prisma Browser supports two hosting models. Both models appear in the same EDL picker in the rule wizard and support the same policy actions.
    Hosting ModelDescriptionUse When
    Self HostedThe list is hosted on a publicly accessible HTTPS server. The Prisma Browser fetches the list directly from its URL according to the refresh interval configured on the EDL.The list is a public vendor or community feed, or the list is already published for firewalls.
    Strata Cloud Manager HostedStrata Cloud Manager ingests the list from a Git repository, an API endpoint, or an uploaded file, and hosts it on a credentialed feed that only your tenant can access.The list is private to your organization, the source is on a private network, or the list is managed as code in a Git repository.
    The Prisma Browser cloud service cannot reach private networks. If the list source is on an internal network, use a Strata Cloud Manager hosted EDL and upload the list, manually or from a CI/CD pipeline.

    Supported Lists and Limitations

    Prisma Browser DesktopPrisma Browser ExtensionPrisma Browser for Mobile
    Full supportFull supportNo support
    ItemSupport
    List typeDomain lists only. URL and IP lists are not supported and do not appear in the EDL picker.
    Self hosted listsMust be publicly accessible over HTTPS. Lists that require a certificate profile or client authentication (username and password) are not supported.
    Entries per EDLUp to 1,000,000 entries.
    Entries per tenantUp to 4,000,000 entries across all EDLs.
    Refresh intervalConfigured on the EDL in Strata Cloud Manager: every five minutes, hourly, daily, weekly, or monthly.
    LicensesNot available for tenants with a Prisma Access add-on license for Panorama.
    Entries beyond the per-EDL or per-tenant limit are not enforced. Keep lists within the limits to ensure every entry is enforced.

    Domain List Format

    EDL files contain one entry per line. The Prisma Browser applies the following rules when it reads a domain list:
    • Lines that start with # and blank lines are ignored.
    • example.com - Matches the exact domain. When Expand domain is enabled on the EDL, the entry also matches all subdomains.
    • *.example.com - Matches all subdomains of example.com, but not example.com itself.
    • ^example.com - Matches only the exact domain example.com, even when Expand domain is enabled.
    Entries that are not valid domains, such as entries that include a scheme (https://example.com), are not enforced. The number of valid and invalid entries for each list appears in the list details panel.

    Add an External Dynamic List to an Access and Data Control Rule

    Create the EDL in Strata Cloud Manager. New EDLs and changes to existing EDLs can take up to five minutes to appear in the Prisma Browser.
    To add an EDL to an Access and Data Control rule:
    1. From Strata Cloud Manager, select ConfigurationPrisma Browser PolicyRules.
    2. Select the Access & Data Control tab, and create a new rule or edit an existing rule.
      For more information, see Create New Access & Data Control Rules.
    3. Configure the Scope step and select Next: Applications.
    4. On the Applications page, select Internet & SaaS applications, and then select Custom.
    5. In the External dynamic list field, select one or more EDLs.
      • Each list shows an icon that indicates its hosting model: Self Hosted or Strata Cloud Manager Hosted.
      • To review a list before you add it, hover over the list and click the arrow to open the list details panel.
      • To create or edit EDLs, click Manage external dynamic list. Strata Cloud Manager opens in a new tab.
    6. Continue to the action step and select one of the following options:
      • Allow - The Prisma Browser allows access to the domains in the selected EDLs, subject to the rule's data controls.
      • Block - The Prisma Browser blocks access to the domains in the selected EDLs.
      • Prompt - The Prisma Browser prompts the user before granting access to the domains in the selected EDLs.
    7. Configure any additional controls for the rule and click Save.
    8. Review and push the configuration to apply the rule.
    A rule matches when the requested domain appears in any of the selected EDLs, or in any other destination configured in the rule.

    View External Dynamic List Details

    The list details panel shows the following information for each EDL:
    FieldDescription
    DescriptionThe description configured in Strata Cloud Manager.
    TypeThe list type and hosting model.
    SourceThe URL of a self hosted list, or the source name of a Strata Cloud Manager hosted list.
    Check for updatesThe refresh interval.
    RulesThe number of rules that reference the EDL.
    Valid list itemsThe number of enforceable entries. Click the number to view all entries.
    Invalid list itemsThe number of entries that are not enforced.
    Updated atThe date the list content was last updated.
    Excluded domainsDomains excluded from the list in Strata Cloud Manager.

    Monitor External Dynamic Lists

    • Rules table - EDLs appear in the Applications column. To find all rules that reference a specific EDL, filter the rules table by External dynamic lists.
    • Inaccessible lists - If the Prisma Browser cannot fetch a list, a warning icon appears next to the list and in the rules table. Policy enforcement continues with the last synced version of the list. An inaccessible list cannot be added to a new rule.
    • Deleted lists - If an EDL is deleted in Strata Cloud Manager, the list appears with strikethrough text in the rules that reference it. After the configuration is pushed, the list is no longer enforced. Edit the affected rules to remove the deleted list.
    • Browser events - Events that match a rule with an EDL include the Matched external dynamic list field. Filter events by External dynamic list.
    • Audit logs - Creating, updating, and deleting an EDL is recorded under the External dynamic lists category.

    External Dynamic Lists and Configuration Changes

    EDL changes synced from Strata Cloud Manager appear as pending changes in the Prisma Browser configuration. The changes are enforced only after the configuration is pushed.
    EDL changes cannot be discarded in the Prisma Browser. To revert a change, edit the EDL in Strata Cloud Manager.

    © 2026 Palo Alto Networks, Inc. All rights reserved.