>
    Strata Copilot
    Configure Okta for IP-Based Enforcement
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. First-Party Integrations
    4. Enforcing the Browser
    5. IP-Based Enforcement
    6. Configure Okta for IP-Based Enforcement
    Download PDF
    Prisma Browser

    Configure Okta for IP-Based Enforcement

    Table of Contents

    Configure Okta for IP-Based Enforcement

    Allow sign-in to Okta only from the Prisma Browser.
    Where Can I Use This?What Do I Need?
    • Strata Cloud Manager
    • Standalone Prisma Browser
    • Prisma Access with Prisma Browser bundle license or Prisma Browser standalone license
    • Role: Prisma Browser Roles
    IP-based enforcement allows sign-in to your applications only from the Prisma Browser. Okta checks the source IP address of each sign-in request and allows it only when it comes from your tenant IP addresses. A sign-in from any other browser is blocked.
    Follow these steps to limit access to all or specific apps to the Prisma Browser when you use Okta.
    Before you begin, create your tenant IP addresses in step 1 of IP-Based Enforcement.
    To use Okta device posture instead of IP-based enforcement, see Integrate Prisma Browser and Okta with the Device Posture Provider. Choose one method. They are alternatives.
    1. Configure the Prisma Browser Application Enforcement IP Addresses
      1. Configure the Application Enforcement IP Addresses. In the Okta app go to Security > Networks > Add zone > IP zone.
      2. Set the name of the zone to the Prisma Access Authentication Proxy.
      3. In the Gateway IPfield, paste the egress IP Addresses.
      4. Click Save.
      5. Confirm that the new zone appears in the list.
    2. Select Applications and User Groups to Adhere to the Policy
      1. You need to create a new conditional access; Choose Applications -> Applications and click on the app that you want to restrict.
      2. Go to the Sign On tab, scroll down to the User Authentication and click View policy details.
      3. Click Add rule and enter the following information:
        • Name: Allow access only from the Prisma Browser.
        • Users: Select the users or user groups to enforce:
        • User's group membership includes - make sure that you configure this setting for groups.
        • User is - Allows you to apply rules to some specific users, but not to other specific users.
        • Device Platform is - Make sure you select both Windows and macOS.
        • User IP is Select Not in any of the following zones, and select Prisma Access Authentication Proxy.
        • Access is - Select Denied.
        • Click Save.
    3. Return to IP-Based Enforcement and complete step 3 to select Okta and turn on enforcement.

    © 2026 Palo Alto Networks, Inc. All rights reserved.