>
    Strata Copilot
    Prisma Browser for Intune - Supported and Unsupported Capabilities
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. Prisma Browser for Mobile Setup Using Intune
    4. Prisma Browser for Intune - Supported and Unsupported Capabilities
    Download PDF
    Prisma Browser

    Prisma Browser for Intune - Supported and Unsupported Capabilities

    Table of Contents

    Prisma Browser for Intune - Supported and Unsupported Capabilities

    Supported and Unsupported Capabilities

    Overview

    This document details what Prisma Browser for Intune currently supports, what is explicitly not supported (with reasons), and what is planned for upcoming phases.
    Legend
    IconMeaning
    🟢Supported — confirmed working
    🔴Not supported — known limitation
    🟡Partial / In progress

    Conditional Access - Access controls (Entra ID)

    Conditional Access policies in Microsoft Entra ID are critical for organizations controlling access to corporate resources. The following indications are relevant only when they target All resources (formerly 'All cloud apps').
    Conditional Access Grant ControlStatusNotes
    Require multifactor authentication🟢 Supported
    Require authentication strength🟢 SupportedSpecific auth strength policies (e.g., phishing-resistant MFA) are respected.
    Require device to be marked as compliant🟢 SupportedPB for Intune can present the Intune device management certificate to Entra ID, proving the device meets compliance baselines.
    Require app protection policy — configured on cloud app🔴 Not SupportedWhen CA is configured on a cloud app (e.g., M365, Salesforce), PB cannot intercept the CA check. Workaround: Use IdP proxy conditional access to enforce policies at the identity provider level.
    Require password change🟡 N/AThis control applies to user risk policies and is handled by Entra ID directly, not the browser.
    Require risk remediation🔴 Not Supported
    Device platform conditions (iOS/Android)🟢 SupportedCA policies scoped to iOS and/or Android platforms apply correctly.
    When the conditional access policy targets Prisma Browser for Intune, all of the above mentioned policies will not be supported.

    App Protection Policies (Intune)

    Prisma Browser for Intune integrates the Intune SDK. The SDK auto-enforces APP policies configured in the Intune Admin Center through OS-level interception.
    Data Protection
    APP PolicyEnforced?Notes
    Backup org data to iTunes and iCloud backups (iOS only)🟢 Supported
    Backup org data to Android backup services (Android only)🔴 Not SupportedUse profile sync instead
    Send org data to other apps🟢 Supported
    Receive data from other apps🟢 Supported
    Restrict cut, copy, and paste between other apps🟢 Supported
    Screen capture and Google Assistant (Android)🟢 Supported
    Third party keyboards/Approved keyboards🟢 Supported
    Encrypt org data🔴 Not Supported
    Sync policy managed app data with native apps or add-ins🔴 Not Supported
    Printing org data🟢 Supported
    Restrict web content transfer with other apps🔴 Not Supported
    Org data notifications (Android)🟡 Partial
    Allowed / Blocked only.
    ​​Block org data option is not supported.
    Genmoji (iOS)🟢 Supported
    Screen capture (iOS)🟢 Supported
    Writing tools (iOS)🟢 Supported
    Start Microsoft Tunnel connection on app-launch (Android)🟡 N/APrisma Browser has its own tunneling via Prisma Access

    Access Requirements

    APP Policy Enforced?Notes
    PIN for access🟢 Supported
    Work or school account credentials for access🟢 Supported
    Recheck the access requirements after (minutes of inactivity)🟢 Supported

    Conditional Launch

    APP Policy (as it appears in Intune console)Enforced on PB for Intune?Notes
    Max PIN attempts🟢 Supported
    Offline grace period🟢 Supported
    Minimum app version🟢 Supported
    Non-working time🟢 Supported
    Min SDK version🟢 Supported
    Disabled account🟢 Supported
    Jailbroken/rooted devices🟢 Supported
    Min OS version🟢 Supported
    Max OS version🟢 Supported
    Min patch version (Android)🟢 Supported
    Samsung Knox device attestation (Android)🟢 Supported
    Device model(s)/Device manufacturer(s)🟢 Supported
    Play integrity verdict (Android)🟢 Supported
    Require device lock (Android)🟢 Supported
    Require threat scan on apps🟢 Supported
    Min Company Portal version (Android)🟢 Supported

    Deployment and Management

    CapabilityStatusNotes
    Deployment via Intune Admin Center🟢 SupportediOS: App Store app. Android: Play Store app.
    VPP deployment (Apple Business Manager)🟢 SupportedSilent install without App Store login.
    Managed Google Play🟢 SupportedEnterprise deployment on Android.
    Co-existence with standard PB Mobile🟢 SupportedBoth apps can be installed side-by-side. No auto-migration.
    Auto-migration from standard PB to PB for Intune🔴 Not SupportedUsers must install the new app separately. No data migration between apps besides Passwords, bookmarks and History using the sync directive on SCM.No current plans
    Appear in Microsoft's public app list (APP targeting)🟡 In ProgressCurrently not in Intune's public app list. Admins must use custom bundle ID to target APP policies.

    © 2026 Palo Alto Networks, Inc. All rights reserved.