>
    Strata Copilot
    Configure Microsoft Entra ID for IP-Based Enforcement
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. First-Party Integrations
    4. Enforcing the Browser
    5. IP-Based Enforcement
    6. Configure Microsoft Entra ID for IP-Based Enforcement
    Download PDF
    Prisma Browser

    Configure Microsoft Entra ID for IP-Based Enforcement

    Table of Contents

    Configure Microsoft Entra ID for IP-Based Enforcement

    Allow sign-in to Microsoft Entra ID only from the Prisma Browser.
    Where Can I Use This?What Do I Need?
    • Strata Cloud Manager
    • Standalone Prisma Browser
    • Prisma Access with Prisma Browser bundle license or Prisma Browser standalone license
    • Role: Prisma Browser Roles
    • Microsoft P2 Premium licenses at a minimum, including Microsoft 365 business
    IP-based enforcement allows sign-in to your applications only from the Prisma Browser. Microsoft Entra ID checks the source IP address of each sign-in request and allows it only when it comes from your tenant IP addresses. A sign-in from any other browser is blocked.
    Follow these steps to limit access to all or specific apps to the Prisma Browser when you use Microsoft Entra ID.
    Before you begin, create your tenant IP addresses in step 1 of IP-Based Enforcement.
    The Prisma Browser uses the Authentication Proxy for the SSO login pages only. It does not use the proxy for any other traffic.
    1. Create a new Named Location from the Azure Active Directory Admin Center.
      1. Search for the Named Locations from the Admin Center. If available, select the New and improved Named Location.
      2. Click IP range location.
      3. In the New Location <IP> Ranges section, enter the name of the Prisma Browser IP Range.
      4. Paste the egress IP Addresses into a text file.
      5. Upload the file.
      6. Click Create.
      7. Confirm that the new Named Location appears on the list.
    2. Select Applications and User Groups to Adhere to Policy
      1. Navigate to the Azure Conditional Access Portal.
      2. Select New Policy → Create New Policy , and enter the following information:
        • Name - Enter a name. For example, Block access not from Prisma Browser.
        • Assignments - Assign the policy to users or groups. Be sure to include all users who need to connect to applications using the Prisma Browser only.
        • Target Resources - Make sure that the Control access includes cloud apps.
        • Conditions - Apply any needed conditions. Include at least one local condition.
        • Grant - Select Block access.
        • Cloud apps or actions - Select Cloud apps, then include selected applications.
        The Prisma Browser can't be a required application for enforcement.
        If you select All apps, be sure to exclude the Prisma Browser.
        • Enable policy - Set this to On.
      3. Click Create.
    3. Return to IP-Based Enforcement and complete step 3 to select Microsoft Entra ID and turn on enforcement.

    © 2026 Palo Alto Networks, Inc. All rights reserved.