>
    Strata Copilot
    Integrate Prisma Browser with Azure Virtual Desktop
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. Third-Party Integrations
    4. Integrate Prisma Browser with Azure Virtual Desktop
    Download PDF
    Prisma Browser

    Integrate Prisma Browser with Azure Virtual Desktop

    Table of Contents

    Integrate Prisma Browser with Azure Virtual Desktop

    PAB integration with AVD
    This integration provides a unified workspace experience for end users, allowing organizations to enforce consistent security policy rules across both web-based and traditional desktop applications. It ensures secure, seamless access to resources from any device, supporting a flexible and secure work environment.
    The Azure Virtual Desktop (AVD) integration provides a unified workspace experience for end users, allowing organizations to enforce consistent security policy rules across both web-based and traditional desktop applications. It ensures secure, seamless access to resources from any device, supporting a flexible and secure work environment.

    Azure Configuration Requirements

    To enable proper mapping of applications and desktops in the Prisma Browser, ensure the following conditions are met:
    • User Consistency: The user logged into the Prisma Browser must be the same user connecting to AVD applications and desktops.
    • Client Requirement: End users must connect to AVD using the Windows App Web Client. The legacy Windows Remote Web Client is not supported.
    • Application Assignment: AVD applications are assigned to users or user groups through application groups. These application groups must be mapped to the appropriate host pools.

    Minimum AVD Environment Configuration

    The AVD deployment must include the following components at a minimum:
    • at least one host pool
    • at least one workspace
    • At least one application group that includes published applications
    • User or group assignments associated with the application group

    Azure Configuration Prerequisites to Connect to Prisma Browser

    1. Create a new app on the Azure Portal:
      1. In the Azure portal, go to App registrations and click + New registration.
      2. Insert an descriptive application name, such as, Prisma Browser Azure Virtual Desktop Integration.
      3. Under Supported account types, select Accounts in this organizational directory only (<my_tenant_name> - Single tenant).
      4. Click Register.
    2. Add a new Client Secret
      1. Click on the created application registration.
      2. Go to Certificates & secrets and click + New client secret.
      3. [optional] Add a description.
      4. lick Add,
      5. Copy the value of the newly added client secret (you’ll use it in Prisma Browser Settings).
    3. Add Permissions to the New App Registration
      Learn more about role-based access in Azure.
      1. Add permissions to the new app registration:
        Go to App registrations > Select your App > API Permissions > Add a permission > Microsoft Graph > Applications permissions.
        Select the following permissions (make sure to provide admin consent if required:
        • RoleManagement.Read.All
        • Group.Read.All
        • User.Read.All
      2. For Above go to Subscription with the configured Azure Virtual Desktop > Select Your Subscription Name > Access Control IAM
        Two options to define it (choose only one):
        • For Above go to Subscription with the configured Azure Virtual Desktop > Select Your Subscription Name > Access Control IA
        • Specific roles:
          1. Add > Add role assignment > Role = Desktop Virtualization Reader, Members (select members) = Select the application registration for the previous step and add
          2. Add > Add custom role -> Add permissions -> Find Microsoft Authorization -> Choose “Read: Get role assignment” and Choose “Read: Get role assignment schedule.”
          3. Add > Add role assignment > Role = the custom role, Members (select members) = Select the application registration for the previous step and add:

    Complete the Registration in Prisma Browser

    1. Go to Prisma Browser admin console → Integrations.
    2. Under Virtual Desktop Infrastructure (VDI) integration, open Azure Virtual Desktop.
    3. Insert a descriptive name for the connection.
    4. Enter Tenant ID from your Azure Entra ID.
    5. Enter your Azure Subscription ID where you have AVD configured.
    6. Enter Application ID from your application registration.
    7. Enter the Application Registration Client Secret copied on the previous steps.
    8. Resource group name - provide the name of the resource group where all your AVD resources are configured.

    What Happens After Connecting the Integration

    • The end user will get a Desktop Applications section in the new tab, mapping only the relevant apps for the user.
    • Manually create a custom application (SaaS) to identify AVD's RemoteApp application.
    • All URLs start with the following path - this can represent all AVD apps: https://windows365.microsoft.com/webclient/avd/****
    • The URL path is built as follows: https://windows365.microsoft.com/webclient/avd/ {workspaceObjectId}/{applicationObjectId}
      • To be more specific, when you can create it based on workspace - it will include all applications inside the application groups registered with the workspace.
      • To retrieve *{workspaceObjectId}:
        • from Azure go to portal → Azure Virtual Desktop → Workspaces → choose specific workspace → Click on the “JSON View” and locate the “ObjectID” value.
      • Example URL for the workspace:
        • https://
          //windows365.microsoft.com/webclient/avd/b1e4a514-da64-4fa1-a9bb-4ca8e7aa4b76/*
        • Or use Azure PowerShell
        • https://
          //learn.microsoft.com/en-us/azure/virtual-desktop/cli-powershell?tabs=cli#retrieve-the-object-id-of-a-host-pool-workspace-application-group-or-application
    • To create it for a specific application:
    • Desktops use the same URL structure, with {applicationObjectId} in the same place as for apps.

    Conditional Access for AVD Apps Using Prisma Browser Only

    The following information is for Generic Conditional Access Guidelines:
    For specifically identifying AVD apps, follow these instructions:
    1. Go to the Azure portal.
    2. Search for Conditional Access
    3. Go to Named Location
      1. Choose IP ranges location.
      2. Add a new Ranges location.
      3. Select a name.
      4. Do not mark it as a Trusted Location.
      5. Choose the Elastic IPs of the IdP proxy (regular of dedicated).
      6. Click Save.
    4. Go to the Policy Rules.
      1. Create a new policy rule.
      2. Select a name.
      3. Select Target resources.
      4. Set Select resources.
      5. Select Azure virtual desktop.
      6. Go to Conditions.
      7. Select locations.
      8. Mark configure: YES.
      9. Set Include.
      10. Select Any network or location.
      11. Set Exclude.
      12. Select Selected network and locations.
      13. Pick your named location from section #2.
    5. Go to Access Controls.
      1. Select Grant.
      2. Select Block Access.
      3. Go to For Multiple Controls
      4. Select Require one of the selected controls.
    6. Go to Enable Policy.
      1. Select On.

    Azure Integration Limitations

    Email Matching Requirement
    When identity federation is not based on Azure Active Directory, the system relies on the user's email address to associate them with their applications. Ensure that the email address is identical in both Azure and the identity provider (IdP). Any mismatch will prevent the system from retrieving the user's applications.
    User Information Synchronization
    Discrepancies in user information between the IdP and Azure may result in application identification failures. Ensure consistent user records across both systems.
    Single Resource Group Support
    This integration supports only one Azure resource group. You must specify the target resource group during the Azure integration configuration process.
    Subscription Limitation
    Multiple Azure subscriptions are not supported. Ensure the integration is configured under a single Azure subscription.
    Typing Guard and Input Masking
    AVD applications and desktops do not support Typing Guard or Input Masking features.
    App Attach Support
    Applications deployed via App Attach are not supported by this integration.
    Single Sign-On (SSO)
    Automatic SSO login is currently not available.

    © 2026 Palo Alto Networks, Inc. All rights reserved.