>
    Strata Copilot
    IP-Based Enforcement
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. First-Party Integrations
    4. Enforcing the Browser
    5. IP-Based Enforcement
    Download PDF
    Prisma Browser

    IP-Based Enforcement

    Table of Contents

    IP-Based Enforcement

    Allow sign-in to your applications only from the Prisma Browser by restricting your IdP to your tenant IP addresses.
    Where Can I Use This?What Do I Need?
    • Strata Cloud Manager
    • Standalone Prisma Browser
    • Prisma Access with Prisma Browser bundle license or Prisma Browser standalone license (paid and production tenants only)
    • Prisma Browser Roles
    IP-based enforcement makes sure that users can sign in to your applications only from the Prisma Browser. The Prisma Browser sends authentication traffic through an Authentication Gateway, which is a forward proxy. Your IdP then allows sign-in only from your tenant IP addresses, so a sign-in from any other browser is blocked.
    If you currently use legacy shared IP addresses, see Migrate from Legacy Shared IP Addresses to Dedicated IP Addresses.
    In FedRAMP Moderate environments, IP-based enforcement supports only the shared Authentication Gateway. Dedicated IP addresses aren't supported.

    Platform Support

    IP-based enforcement supports both Prisma Access Browser (PAB) and Prisma Access Mobile Browser, providing consistent protection across desktop and mobile platforms.

    How it Works

    The IP-based enforcement feature works through a simple yet effective mechanism:
    1. The Authentication Gateways serves as a forward proxy: The Authentication Gateways functions as a forward proxy with a set of predictable IP addresses specific to your tenant.
    2. Configured traffic routing: The browser’s configuration routes IdP authentication traffic through the Prisma Access Browser gateway.
    3. IdP conditional access: You establish conditional access rules in your identity provider to only enable authentication from your Authentication Gateway egress IP addresses.
    4. Enforced access control: As a result, authentication attempts from browsers other than PAB will fail, effectively restricting access to your protected applications.

    Key Benefits

    • Tenant-specific egress IPs: Your tenant receives unique IP addresses not shared with other customers.
    • Multitenant validation: Easily verify traffic from specific tenants, even when managing multiple tenants.
    • Regional availability: Available in strategic global locations with automatic failover protection.

    Supported Regions

    IP-based enforcement is available in the following GCP compute regions:
    • us-east4 (Ashburn, Virginia)
    • us-west1 (Portland)
    • europe-west2 (London)
    • europe-west3 (Frankfurt)
    • Asia-south1 (Mumbai)
      IP-based enforcement operates across all five regions by default, and the system doesn’t allow selecting individual regions.
    These regions don't apply to FedRAMP Moderate environments.

    Configure IP-Based Enforcement

    Before you begin, complete Step 1 - Users of the onboarding workflow, which includes configuring the Cloud Identity Engine.
    After you turn on enforcement, users can't sign in to the protected applications from any other browser or network, including administrators. Test with one application and a pilot group first, and keep a break-glass administrator who isn't covered by the IdP rule.
    1. Get your tenant IP addresses.
      1. From the Strata Cloud Manager, go to Configuration → Onboarding → Prisma Browser → View → Step 4: Enforce SSO Applications.
      2. Click Create IP addresses.
        This process can take a few minutes until the IP addresses are available in all regions.
        In FedRAMP Moderate environments, the page shows the shared IP addresses and doesn't have a Create IP addresses button. Skip this substep and copy the list of IP addresses.
      3. Copy the list of generated IP addresses for use in your IdP configuration.
    2. Configure your identity provider (IdP) to allow sign-in only from these IP addresses.
      1. Follow the guide for your IdP:
        IdPGuide
        IdiraConfigure Idira for IP-Based Enforcement
        OktaConfigure Okta for IP-Based Enforcement
        Microsoft Entra IDConfigure Entra ID for Prisma Browser Application Sync
        OneLoginConfigure OneLogin for IP-Based Enforcement
        PingOneConfigure PingOne for IP-Based Enforcement
        JumpCloudConfigure JumpCloud for IP-Based Enforcement
        Workspace ONEConfigure Workspace ONE for IP-Based Enforcement
      2. If your IdP isn't in the list or you use a custom IdP, contact Support or your account team to configure your custom IdP URL.
    3. Turn on enforcement.
      1. In Step 4: Enforce SSO Applications, select your IdP and click Save. If you use multiple IdPs, you can select more than one.
        From this point on, users can access the SSO applications only through the Prisma Browser.
      2. Turn on the Traffic is routed toggle.
        If you currently use legacy shared IP addresses, see Migrate from Legacy Shared IP Addresses to Dedicated IP Addresses.
      3. Validate the configuration by logging in to an enforced application in your IdP:
        • Test using a commercial browser - the system should deny access.
        • Test using the Prisma Browser - the system should grant access.

    Migrate from Legacy Shared IP Addresses to Dedicated IP Addresses

    This section is only for customers who still use legacy shared IP addresses and need to move to dedicated IP addresses. If you are setting up IP-based enforcement for the first time, skip this section and follow the steps above.
    If you're already using IP address-based enforcement with shared IP addresses, follow these steps to migrate to dedicated IP addresses:
    1. Access the New Interface: The Admin Console will display a new dedicated IP address tab.
    2. Create Unique IP addresses: Generate your tenant-specific dedicated IP addresses.
    3. Update IdP: Add the new IP addresses to your IdP's conditional access policy rule.
    4. Switch Enforcement Method: Change to “Dedicated IP addresses” in the web interface, and click Save.
    Important Migration Notes:
    • When migrating, keep the original shared IP addresses in your IdP's configuration as a fall back.
    • If you encounter issues with the new configuration, you can temporarily switch back to shared IP addresses in the admin console.
      Mobile browsers with versions older than [1.5093 for iOS, 1.5096 for Android] will continue using the old shared IP addresses until upgraded to the minimum supported version.

    Troubleshooting

    If you encounter issues with IP-based enforcement:
    • Check your browser's troubleshooting page. :
      • Click the Prisma Access Browser Extension icon in the menu bar.
      • Click the shield icon.
      • Open the Authentication Gateway section.
      • Ensure that the Status shows Configured, and that no errors appear.
      • Click Test Connectivity. Follow the instructions as needed.
    • Ensure that you have correctly configured the IP addresses in your IdP.
    • Turn on the Traffic is routed toggle.
    • If the issues persist, contact Support.

    Frequently Asked Questions (FAQ)

    Q: How long does it take for IP addresses to become available?
    A: The process typically takes a few minutes to complete across all supported regions.
    Q: Can I use the same IP addresses across multiple tenants?
    A: No, each tenant receives unique IP addresses to ensure proper isolation and security. For organizations managing multiple tenants, including all relevant IP addresses in the conditional access configuration is crucial.
    Q: How long will the IP addresses remain reserved?
    A: The system allocates your IP addresses to your tenant for as long as your tenant remains active and IP addresses are enabled for your tenant.
    Q: Which platforms support the Authentication Gateway?
    A: The feature is available for both Prisma Access Browser for desktop and mobile.
    Q: What is the expected behavior if the dedicated Authentication Gateways is configured, but the user has an old browser version?
    A: Old browser versions will keep sending traffic to the legacy Authentication Gateway (“shared proxy”) until the browser is up to date. For desktop browsers, the extension version should be automatically updated immediately after the next browser launch. For the Mobile Browser, ensure that users update to a supported version.
    Q: What does the traffic flow look like if I configure “route all traffic to Prisma Access”?
    A: When you enable the authentication routing, the authentication traffic will be routed through the authentication proxy regardless of the general traffic routing to Prisma Access.
    Q: What happens if a region becomes unavailable?
    A: The system or browser automatically routes users to the second-nearest available region to maintain service continuity.
    Q: Can I see all the Traffic logs in SLS?
    A: Currently this isn’t available.
    Q: My tenant is in a different region than the Authentication Gateways. What will happen?
    A: Authentication traffic will be routed through the region nearest to the user.
    Q: Can I use IP-based enforcement with an Eval/Lab license?
    A: The creation of IP addresses is a feature of paid subscriptions. If you're on a trial or require access through a different arrangement, contact your account team.
    Q: Does IP-based enforcement work in FedRAMP Moderate environments?
    A: Yes, but only with the shared Authentication Gateway. FedRAMP Moderate environments don't support dedicated IP addresses.

    © 2026 Palo Alto Networks, Inc. All rights reserved.