Get User and Group Information Using the Cloud Identity Engine

Create a Cloud Identity Engine instance for Prisma Access, and make a note of the instance name.
When you activate the Cloud Identity Engine, it creates an instance. You use the instance name when you associate the Cloud Identity Engine with Prisma Access in a later step. Optionally, if you need to create a separate instance for Prisma Access, create it and make a note of the instance name.
Configure the Cloud Identity Engine to retrieve your directory data.

(
Deployments with on-premises Active Directory only
) If you use an on-premises Active Directory, Install and configure the Cloud Identity Agent to communicate with your on-premises AD and configure mutual authentication between the Cloud Identity Engine service and the agent.
Associate the Cloud Identity Engine with the Panorama app.
Log in to the hub, click the gear icon to edit the

Settings

, then

Manage Apps

.

Select the Panorama app.



Select the

Cloud Identity Engine

instance you want to associate with the app and click

OK

.


Associate the Panorama that manages Prisma Access with Cloud Identity Engine in the hub.
Using the Cloud Identity Engine with Prisma Access is not supported in a multitenant environment.
Find the serial number of the Panorama that manages Prisma Access by selecting the

Dashboard

and noting the

Serial #

that displays.



Log in to the Palo Alto Networks hub and select

Panorama

.

Find the serial number of the Panorama that manages Prisma Access, select it, then select

Add Directory Sync

.



Enter the

Directory Sync

instance you retrieved in Step 1.

You do not need to select the

Region

; the Cloud Identity Engine uses the same region that Prisma Access uses for Cortex Data Lake.



Click

OK

when complete.

(

Optional

) If you need to edit an existing Cloud Identity Engine instance after you create it, select

Prisma Access - DirSync Mapping

, select the Panorama’s serial number, select

Edit

, and enter the following information in the window that displays:

Enter a
Name
for the Cloud Identity Engine - Prisma Access mapping.
Optionally, enter a
Description
for the mapping.
Select the
Directory Sync
instance name that you noted in Step 1.

The

Region

and

Serial Number

fields populate automatically.




Enable the Cloud Identity Engine on Prisma Access.
On the Panorama that manages Prisma Access, select one of the following tabs:.
To configure Cloud Identity Engine for Prisma Access for mobile users, select
Panorama
Cloud Services
Configuration
Mobile Users—GlobalProtect
or
Panorama
Cloud Services
Configuration
Mobile Users—Explicit Proxy
, select the gear icon to edit the settings, then select
Group Mapping Settings
.

To configure Cloud Identity Engine for Prisma Access for remote networks, select
Panorama
Cloud Services
Configuration
Remote Networks
, select the gear icon to edit the settings, then select
Group Mapping Settings
.
Select
Enable Directory Sync Integration
to enable Cloud Identity Engine with Prisma Access.
Enter the following information:
Enter the
Primary Username
(the logon name attribute for the user, such as
userPrincipalName
or
sAMAccountName
). This field is required.
Prisma Access supports the userPrincipalName (UPN) attribute that is used with Azure AD and Okta Directory. If you configure Azure or Okta as the identity provider (IdP) in the Cloud Identity Engine, specify the
Primary Username
as
userPrincipalName
.
(
Optional
) Enter the
E-Mail
attribute (such as
mail
).
(
Optional
) If you use alternate name attributes for the user, enter them. You can enter up to three alternate user names (
Alternate User Name 1
,
Alternate User Name 2
, and
Alternate User Name 3
).
Click
OK
when complete.
Commit and push (
Commit
Commit and Push
) your changes.