Focus

Tenant Service Group (TSG) Migration of Prisma SD-WAN Users

Table of Contents

Filter

Expand All | Collapse All

Prisma SD-WAN Docs

Administration
Deployment
Incidents & Alerts
CloudBlades
Version
- AWS Transit Gateway
- Azure vWAN
- Azure vWAN with vION
- ChatBot for MS Teams
- ChatBot for Slack
- CloudBlades Integration with Prisma Access
- GCP NCC
- Service Now
- Zoom QSS
- Zscaler Internet Access
Reference
Release Notes
Version
- ION 5.2
- ION 5.3
- ION 5.4
- ION 5.5
- ION 5.6
- ION 6.0
- ION 6.1
- ION 6.2
- ION 6.3
- ION 6.4
- New Features Guide
- On-Premises Controller
- Prisma Access CloudBlade Cloud Managed
- Prisma Access CloudBlade Panorama Managed
- Prisma SD-WAN CloudBlades

Features Introduced in March 2023

Prisma SD-WAN Features Introduced in 2022

Tenant Service Group (TSG) Migration of Prisma SD-WAN Users

Learn about the migration process of Prisma SD-WAN users to TSG.

Starting from June 2023, we will begin the next phase of transitioning Prisma SD-WAN tenants activated before June 2022 to the SASE platform. If your tenant uses third-party IDP or Custom Roles, you will be included in this phase of migration. If your tenant was activated after June 2022, you are already on the SASE platform and no migration is required.

What does this migration mean?

In the backend, we are continuing the migration of Prisma SD-WAN tenants to a common TSG structure (Tenant Service Group) starting from June 2023.

A TSG can contain instances of multiple products (For example, one TSG can contain a Prisma SD-WAN instance, PA instance, CDL instance, and CDSS service instance.)
Users will have access to IAM (Identity and Access Management) module for user roles and permissions and access to APIs from a centralized API gateway.
Users will now be able to utilize the new SASE SDK, which will support other SASE services in addition to Prisma SD-WAN.
Current Prisma SD-WAN APIs and its endpoints will continue to function post migration.
Users will not have any service disruption or any impact on the infrastructure or data paths.

What will a user see after this transition?

If you use local user access, you may receive an email after the migration has occurred with instructions to access Prisma SASE. See the Prisma SASE activation workflow. If you are using a third-party IDP, you will not receive an email.
If you are identified as a user that requires to be onboarded into PANW IDP (CSP), you will be able to log in to the Prisma SD-WAN web interface, but will see a Login timer banner for 30 days advising you to finalize your user creation in PANW IDP (CSP). After 30 Days, access via direct login will no longer be allowed.
All new license activations will be managed from the subscriptions and tenants page on cloud.apps.paloaltonetworks.com. This page will handle all license activations, and provide the ability to manage multiple tenants.
All existing users will be managed through the SASE Portal or the Palo Alto Networks Hub. Any changes to the users and roles would have to be made on Identity and Access Management on cloud.apps.paloaltonetworks.com going forward. All existing user roles will be mapped to the same or similar role on Identity and Access Management.
Note that after you are transitioned, you will have access to an all-new revamped Palo Alto Networks TSG Aware hub, wherein you can view apps per tenant. If you are in hub light mode, click SASE platform to access cloud.apps.paloaltonetworks.com and the Prisma SD-WAN application.

Features Introduced in March 2023

Prisma SD-WAN Features Introduced in 2022

Prisma SD-WAN Docs

Tenant Service Group (TSG) Migration of Prisma SD-WAN Users

Prisma SD-WAN Docs

Tenant Service Group (TSG) Migration of Prisma SD-WAN Users

Activation & Onboarding

SASE

Visibility & Monitoring

Hardware Reference

Hardware Quick Start Guides

Virtual ION Deployment

Prisma SD-WAN Integration

Prisma SD-WAN Experts Corner

Best Practices