Enforcing the Browser
Make the Prisma Browser the only way that users can reach your
applications.
| Where Can I Use This? | What Do I Need? |
|---|
- Strata Cloud Manager
- Standalone Prisma Browser
|
- Prisma Access with Prisma Browser bundle license or Prisma Browser standalone license
- Role: Prisma Browser
Roles
|
Users can access your SaaS and web applications from any browser, including
unmanaged ones. Enforcement closes this security gap by configuring your identity
provider (IdP) or application to require Prisma Browser for sign-in, blocking
unmanaged browsers at authentication.
Prisma Browser supports three enforcement methods applied at the IdP or
application level. The ideal method depends on your existing setup.
| Method | How It Works | Supported IdPs or Applications |
|---|
| IP-Based
Enforcement | The Prisma Browser routes authentication traffic through a proxy
that uses your tenant IP addresses. Your IdP allows sign-in only from
those IP addresses. | Idira, Okta, Microsoft Entra ID, OneLogin, PingOne, JumpCloud,
Workspace ONE |
|
| Certificate-Based
Enforcement | Each browser gets a unique client certificate issued by your tenant's
dedicated PKI. The application accepts sign-in only when the browser
presents the certificate. | Google Workspace |
Choose a Method
| If You Use | Use |
|---|
| Idira, Microsoft Entra ID, OneLogin, PingOne, JumpCloud, or
Workspace ONE | IP-based enforcement |
| Okta | IP-based enforcement or device posture conditional access. Choose
one. They are alternatives and you don't combine them. |
| Google Workspace | Certificate-based enforcement |
Whichever method you choose, test it with a pilot group first. After enforcement is
on, users can't sign in to the protected applications from other browsers, so keep
an administrator account that your enforcement rule doesn't cover.
In FedRAMP Moderate environments, IP-based enforcement
supports only the shared Authentication Gateway.
