>
    Strata Copilot
    Prisma Browser Guest Mode
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. Prisma Browser Guest Mode
    Download PDF
    Prisma Browser

    Prisma Browser Guest Mode

    Table of Contents

    Prisma Browser Guest Mode

    Prisma Browser Guest Mode
    Where Can I Use This?What Do I Need?
    • Windows deployment
    • Prisma Browser v149 or later
    This article discusses the following topics:
    • Overview - What Guest Mode is, and when it applies.
    • Configuration - Enabling Guest Mode via registry keys
    • Behavior - User experience in a Guest session
    • Security Consideration - Risks of unauthorized activation and recommended guardrails to protect your environment
    Guest Mode bypasses all Prisma Browser security controls by design (including DLP, URL filtering, and threat prevention). Review the Security Considerations section before deploying this feature.
    In enterprise environments where Prisma Browser is deployed as the sole web browser, users who are unable to authenticate to the managed environment cannot access web resources. Guest Mode resolves this by offering an ephemeral, unmanaged browsing session directly from the login interface.

    Guest Mode Configuration

    Guest Mode is supported exclusively on Microsoft Windows and is configured via local registry policies. System administrators can deploy this registry key to endpoints requiring emergency internet connectivity.
    Registry Path: HKLM\SOFTWARE\Policies\Palo Alto Networks\PrismaAccessBrowser
    PropertyValue
    Value NameGuestModeAccessibility
    Value TypeREG_DWORD
    Value Data1 (Enabled) or 0 (Disabled)

    Guest Session Behavior

    When a user selects "Continue as Guest" on the login screen, the browser initiates an ephemeral session with the following characteristics:
    • Opens an unmanaged browser window that is visually distinct from standard managed sessions.
    • Operates without security policy enforcement (including DLP, URL filtering, and threat protection).
    • Automatically purges all session artifacts (browsing history, cookies, and cache) immediately upon closing the window.

    Guest Mode Limitations

    • Private Applications: Internal applications relying on Prisma Browser secure tunneling remain inaccessible.
    • IdP Enforcement: Guest Mode does not bypass identity-based access controls at the application layer; IdP-protected apps remain inaccessible.

    Security Considerations

    Risk: Unauthorized Activation

    Any entity with write access to the registry can enable Guest Mode, potentially allowing local administrators or malware to bypass enterprise security policies or establish exfiltration channels.

    Recommendations

    1. Restrict Registry Key Write Access

    Harden registry ACLs to limit write access strictly to SYSTEM and Domain Admins, explicitly removing write permissions for the local Administrators group.

    2. Monitor for Unauthorized Changes

    Utilize SIEM or EDR solutions to alert on modifications to the Guest Mode registry key, specifically monitoring for Event ID 4657 when the subject is not a trusted service account.

    3. Use Group Policy to Enforce Key Values

    Deploy the registry configuration as a Group Policy Object (GPO) Policy rather than a Preference. Policy-based settings re-apply during every Group Policy refresh cycle (default: 90 minutes), automatically overriding local modifications.

    4. Endpoint Detection Rules

    Configure Cortex XDR or equivalent Endpoint Detection and Response tools to alert on processes targeting the PaloAltoNetworks\PrismaAccessBrowser registry path, excluding legitimate system processes such as gpupdate.exe or svchost.exe.

    Summary - Defense in Depth Approach

    ConditionAction
    Key set to 1 by a local user accountHigh-priority alert
    Key set to 1 outside approved change windowMedium-priority alert
    Key set to 1 on endpoints not in the approved Guest Mode OUHigh-priority alert

    Use Group Policy to Enforce Key Value

    Deploy the key as a Policy (not a Preference) via GPO. Policy-based registry values are re-applied at every Group Policy refresh interval (default: 90 minutes), automatically reverting any local tampering.
    Steps:
    1. Create a policy that sets GuestModeAccessibility = 0
    2. Link it to all OUs except those where Guest Mode is explicitly needed during outages
    3. Any local modification will be overwritten at the next GP refresh cycle

    Endpoint Detection Rules

    Create detection rules in your EDR/XDR platform (e.g., Cortex XDR) to flag processes writing to the PaloAltoNetworks\PrismaAccessBrowser registry path that are not:
    • gpupdate.exe or svchost.exe (Group Policy client)
    • Your approved configuration management tool
    Summary of Defense-in-Depth Approach
    LayerControlPurpose
    PreventiveRegistry ACLsBlock unauthorized writes
    DetectiveSIEM/EDR alertsDetect unauthorized activation
    CorrectiveGPO refresh cycleRestore correct state

    © 2026 Palo Alto Networks, Inc. All rights reserved.