Configure Mobile Users using Cloud Identity Engine (Recommended)

From Prisma Access, open the Cloud Identity Engine app associated with your tenant.
Go to
Prisma Access
Tenants and Services
Cloud Identity Engine
.

Download the SP Metadata in the Cloud Identity Engine app.
Go to
Authentication
Authentication Types
Add New
.
Set Up
a SAML 2.0 authentication type.
Download SP Metadata
.

Log in to the Azure Portal and select
Azure Active Directory
.
Make sure you complete all the necessary steps in the Azure portal.

If you have more than one directory,
Switch directory
to select the directory you want to use with the Cloud Identity Engine.

Select
Enterprise applications
and click
New application
.

Search for
Palo Alto Networks Cloud Identity Engine - Cloud Authentication Service
and create the Azure AD single-sign on integration.
Customize the app name if required while creating the application.
After the application loads, select
Users and groups
, then
Add user/group
to
Assign
them to this application.
Select the users and groups you want to have use the Azure IdP in the Cloud Identity Engine for authentication.
Be sure to assign the account you are using so you can test the configuration when it is complete. You may need to refresh the page after adding accounts to successfully complete the test.
Set up single sign-on
then select
SAML
.
Upload Metadata File
by browsing to the metadata file that you downloaded from the Cloud Identity Engine app in 2.c and click
Add
.
After the metadata uploads, enter your regional endpoint as the
Sign-on URL
using the following format: https://<RegionUrl>.paloaltonetworks.com/sp/acs (where <RegionUrl> is your regional endpoint).
Alternatively, copy the reply URL to the sign on URL.
Save
your configuration.
Download
the
Federation Metadata XML
under
SAML Certificates
.
Add Azure as an authentication type in the Cloud Identity Engine app.
In Cloud Identity Engine app, select
Authentication
Authentication Types
Add New
.
Set Up
a SAML 2.0 authentication type.
Enter a
Profile Name
.
Select
Azure
as your
IDP Vendor
.
Upload Metadata
from 2.l to
Add Metadata
.

Click to Upload
.
Test SAML Setup
to verify the profile configuration.
Select the SAML attributes you want Prisma Access to use for authentication and
Submit
the IdP profile.
Add an authentication profile.
Select

Authentication

Authentication Profiles

Add Authentication Profile

.

Enter a

PROFILE NAME

.

Select an

Authentication Mode

.

Select the

Authentication Type

from 3 and

Submit

.


Add the authentication profile from Cloud Identity Engine to Prisma Access.
In Prisma Access, select

Manage

Configuration

Identity Services

Authentication

Authentication Profiles

.

Ensure to set the scope to

GlobalProtect

or

Explicit Proxy

mobile users.

Add Profile

.

Select

Cloud Identity Engine

as your

Authentication Method

.

Enter a

Profile Name

.

Select the

Profile

you added in the Cloud Identity Engine app from 4.

Save

the changes.


Attach the authentication to mobile users.
For GlobalProtect mobile users
Select
Manage
Service Setup
GlobalProtect
Infrastructure
Add Authentication
.
Select all required fields and the
Profile
you added to Prisma Access in 5.
Save
the changes.

Move the authentication to the top of the list to prioritize it.
For explicit proxy mobile users
Select
Manage
Service Setup
Explicit Proxy
.
Edit the
User Authentication
settings.
Create New
profile.
Select the
Cloud Identity Engine
authentication method.
Enter a profile name.
Select the
Profile
you added to Prisma Access in 5.
Save
the changes.
Move the authentication to the top of the list to prioritize it.
(
For GlobalProtect mobile users only
) Edit the default browser settings for the GlobalProtect app.
Select the
Default
app settings.
Go to
App Configuration
Show Advanced Options
Authentication
.
Select the
Use Default Browser for SAML Authentication
.
Save
the changes.
Push
the changes.
(
Optional
) Verify the user authentication.
For GlobalProtect mobile users
Log in to a Windows machine and connect to the GlobalProtect app.
The default browser takes you to SAML authentication.
Enter the credentials and sign in.
View
Settings
in the GlobalProtect app to see the connection details.
Log in to Prisma Access and select
Activity
Logs
Log Viewer
.
You can see that the authentication is successful.
For explicit proxy mobile users
Copy the PAC file URL to the endpoint.
Go to
Manage
Service Setup
Explicit Proxy
Infrastructure Settings
to view the PAC file URL.
Log in to a Windows machine.
Edit the
Proxy Settings
and paste the PAC file URL to the
Script Address
.
Access a URL that requires authentication.
Enter the credentials.
In Prisma Access, view the user mapping information by running the
show user ip-user-mapping all
command.
(
Optional
) In Prisma Access, select
Insights
Mobile Users - Explicit Proxy
.
View details about mobile users connected for a time range you select.