>
    Request SAML Access
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma SD-WAN
    3. Prisma SD-WAN Administrator Authorization and Authentication
    4. Single Sign On Access using SAML
    5. Request SAML Access
    Download PDF
    Prisma SD-WAN

    Request SAML Access

    Table of Contents

    Request SAML Access

    Let us learn to request SAML access to the Prisma SD-WAN.
    Where Can I Use This?What Do I Need?
    • Prisma SD-WAN
    • Prisma SD-WAN license
    Request for SAML Single Sign On (SSO) access from Palo Alto Networks Customer Support.
    1. Submit a request to enable SAML access to the Prisma SD-WAN web interface.
    2. Palo Alto Networks Customer Support receives the request.
    3. Palo Alto Networks Customer Support confirms that the account for the administrator exists in the system.
      The next step is to exchange metadata between Palo Alto Networks Service Provider (SP) and your IdP.

    Exchange SAML Metadata

    Metadata exchange between Palo Alto Networks Service Provider (SP) and your IdP occurs prior to enabling SAML. Palo Alto Networks requires contact information of the person responsible for authorizing SAML setup.
    Only support_admin or support_super users can set up SSO using SAML. Ensure you have the required set of permissions and privileges to initiate the SAML setup.
    1. Palo Alto Networks provides Service Provider (SP) metadata <sp_meta_data_file> to configure within your IdP system.
      The communication between the Service Provider and the IdP is part of the pre-setup configuration outside of the Prisma SD-WAN web interface using emails.
    2. Import the Palo Alto Networks Customer Support provided SP metadata into your IdP system.
    3. Generate your IdP metadata <idp_meta_data_file> and provide it to Palo Alto Networks Customer Support.
    4. Provide custom role-mapping instructions to Palo Alto Networks, if any.
      If you require custom role mapping, you must provide group names and role mapping instructions to Palo Alto Networks.
      If you decide to use Palo Alto Networks groups, you must tag your end users with Palo Alto Networks groups in your IdP system. Create Palo Alto Networks suggested groups within your IdP system and add end users to the groups to access the Prisma SD-WAN web interface. Or provide group-to-role mapping instructions to Palo Alto Networks to configure in the Prisma SD-WAN web interface.
    5. Palo Alto Networks receives and configures the IdP metadata in the Prisma SD-WAN web interface.
      After the above process is complete, SAML is enabled. See Palo Alto Networks and IdP metadata to view sample Palo Alto Networks and IdP metadata.
      Only an IAM Admin, Super, or Root user, whose email domain matches the SAML domain, can modify AAA Configuration using the Prisma SD-WAN web interface, other than Palo Alto Networks Customer Support.

    © 2025 Palo Alto Networks, Inc. All rights reserved.