>
    Strata Copilot
    Activate SaaS Security Inline for NGFW
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. Activate SaaS Security Inline for NGFW
    Download PDF
    SaaS Security

    Activate SaaS Security Inline for NGFW

    Table of Contents

    Activate SaaS Security Inline for NGFW

    Learn how to activate SaaS Security Inline on your Palo Alto Networks NGFW.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Panorama or Strata Cloud Manager)
    • Prisma Access (Managed by Panorama or Strata Cloud Manager)
    • SaaS Security Inline license
    • NGFW or Prisma Access license
    Or any of the following licenses that include the SaaS Security Inline license:
    • CASB-X
    • CASB-PA
    To unlock the SaaS Security Inline capabilities—SaaS visibility, SaaS policy rule recommendations, and App-ID Cloud Engine (ACE), simply activate SaaS Security Inline using one of the following activation types, depending on whether you have an Enterprise Level Activation (ELA) license type or non-ELA:
    • (non-ELA) Activation email that you received.
    • (ELA) Hub ELA Activations menu.
    • (ELA) Customer Support Portal Enterprise Agreements page.
    If you're adding SaaS Security Inline to a firewall that is already enforcing App-ID based security policy rules, activating SaaS Security Inline might result in unexpected changes in policy enforcement. These unexpected changes might occur because the App-ID Cloud Engine (ACE) included with SaaS Security Inline gives you visibility and control into thousands of applications that were previously identified generically as SSL or web-browsing applications. When ACE identifies an application that was previously classified as SSL or web-browsing, it reclassifies the application with the new specific App-ID. Traffic for this App-ID will be blocked or allowed based on the first security policy rule it matches. Because the application is now classified with a specific App-ID, it will no longer match rules that are configured for the generic SSL or web-browsing App-IDs. The firewall might now block traffic that it previously allowed, possibly resulting in unintentional business interruption. Conversely, the firewall might allow traffic that it previously blocked, potentially leading to security gaps.
    If you're adding SaaS Security Inline to a firewall that is already enforcing App-ID based security policy rules, update your security policy rulebase for ACE App-IDs.
    If you're enabling SaaS Security Inline for Next-Generation CASB, activate in SASE Cloud Management Console using the activation email you received.
    After activation, your NGFW contact the cloud service and begin to download any SaaS policy rule recommendations that you created.
    SaaS Security Inline activation:
    • Creates a URL for SaaS Security Inline login.
    • Pushes the SaaS Security Inline license to the NGFW that you select. Panorama does not require a license.
    • Enables a secure and encrypted connection and successful, mutual authentication between SaaS Security Inline, Palo Alto Networks NGFW, Panorama, and Strata Logging Service.
    Before you activate:
    • Ensure that your environment meets all the activation requirements for the SaaS Security Inline features you want to enable. (SaaS administrator)
      Requirement
      SaaS Visibility
      SaaS Policy Recommendations and ACE
      One or more NGFW running PAN-OS 10.1 or later with or without Panorama.
      N/A
      Yes
      One new or existing Strata Logging Service license per SaaS tenant.
      Yes
      Yes
      Same Support Account for SaaS tenant, Strata Logging Service, Enterprise DLP, and NGFW.
      Yes
      Yes
      One SaaS Security Inline license per firewall.
      Yes
      Yes
      Enterprise DLP license on NGFW and in the same Customer Support Portal account as the SaaS tenant.
      Only required if you want to use the Data Profiles option for SaaS policy rule recommendations
      N/A
      Yes
      Because SaaS Security Inline requires network traffic data for analysis, you must enable NGFW to forward logs with that data to Strata Logging Service. Your SaaS Security Inline subscription requires that you also have an active Strata Logging Service instance, which stores the data logs from NGFW and streams them to SaaS Security Inline.
    • Start the ACE deployment. (NGFW administrator / SaaS Policy Rule Recommendations)
      ACE deployment is required if you want ACE and SaaS policy rule recommendations. ACE deployment isn’t required for displaying SaaS app visibility data, though you must still configure log forwarding. Without logs for all NGFW, SaaS Security Inline can’t display SaaS app visibility data and might not be able to enforce policy rule recommendations.
      • Bring the NGFW and Panorama (if using) online.
      • Install the device certificate.
    After you activate:
    • Complete your ACE deployment. (NGFW administrator / SaaS Policy Rule Recommendations)
      Again, ACE deployment is required if you want ACE and SaaS policy rule recommendations. SaaS Security Inline does not require ACE deployment to display SaaS app visibility data.
      • Retrieve and verify the SaaS Security Inline license, which the SaaS Security Inline activation pushed to your NGFW. Panorama does not need a license. If you forget to do so, an error displays.
      • Configure service route for data services.
      • Create and verify connections to edge services and cloud service.
      • Enable ACE on Panorama (if using)
    • Configure log forwarding. (NGFW administrator / SaaS Visibility)
      You’re instructed to do so during your ACE deployment. If you only want SaaS visibility features, ACE deployment is optional, but SaaS Security Inline requires log forwarding with or without ACE and SaaS policy rule recommendations enabled.
    1. Initiate the SaaS Security Inline activation process based on your license type.
      An ELA (Enterprise Level Activation) license activates all your NGFW. A non-ELA license activates a fixed number of NGFW.
      • (non‑ELA license) Open your SaaS Security Inline activation email and click Activate, then log in with your Palo Alto Networks Customer Support Portal account credentials.
        The number of Activate buttons in the email you received depends on what you purchased. Each Activate button launches the same onboarding workflow that lets you activate all your purchased products together. Click any Activate button to begin. Additionally, your activation email depends on the type of activation: purchase, trial, or evaluation.
        It's important to keep the SaaS Security Inline activation email you received from Palo Alto Networks. In addition to containing confidential activation-related data, you will need this email to activate more NGFW later if you still have unused SaaS Security Inline licenses after completing the onboarding process.
      • (ELA license) Log in to the hub with your Palo Alto Networks Customer Support Portal account credentials, then select SaaS Security from the ELA Activations menu on the hub.
      • Log in to Customer Support Portal with Super User, Domain Administrator, and ELA Administrator permissions, then navigate to Assets > Enterprise Agreements and click ELA-SaaS Inline Activation.
    2. Select the products to activate, then Start Activation.
      If you have multiple items to activate, leave them all selected when you Start Activation.
    3. (non-ELA) Select a Customer Support Account, then Next
      If you have more than one Support account, select the one with NGFW to subscribe to SaaS Security Inline.
      This step isn’t included in the ELA activation process because you begin the process in the Hub and, therefore, your Support account is already known.
    4. In SaaS Security Inline Setup, configure SaaS Security Inline.
      • Data Lake and Data Lake Region—You must have an active Strata Logging Service or activate a new one now. Do one of the following:
        • New Strata Logging Service—Select Activate New if you're activating a new Strata Logging Service subscription, then choose its region.
        • Existing Strata Logging Service—Select an existing Strata Logging Service instance to use if you did not purchase a new Strata Logging Service. If you have more than one Strata Logging Service instance, choose the one to which NGFW will forward logs with network traffic metadata.
      • SaaS Tenant, SaaS Region, and SaaS Subdomain—Do one of the following:
        • New Tenant—Select Activate New to create a new SaaS Security Inline tenant, then type a subdomain name, which completes the URL for your SaaS Security Inline app and becomes the URL where you log in to the SaaS Security web interface. SaaS Subdomain is prepopulated with the domain name from your email address, but you can change it if you want.
        • Existing Tenant—Select an existing tenant if you did not purchase a new Strata Logging Service or you don’t want to activate a newly purchased Strata Logging Service. Each SaaS tenant requires a unique Strata Logging Service. You can’t reuse a Strata Logging Service tenant. The onboarding process enforces this requirement and automatically populates the SaaS Tenant with the SaaS tenant who is mapped to the existing Strata Logging Service. SaaS Region defaults to Strata Logging Service region.
    5. Choose the Firewalls to enable for this SaaS Security Inline subscription, then Next.
      • (non-ELA) Select a NGFW Model on the left and then select subscriptions for the Serial Number(s) of individual devices belonging to that model on the right. Observe how many SaaS Security Inline subscriptions are assigned and still available for the selected model near the top of the page. Track the number of licenses each model will use and how many are still available in the middle of the page.
      • (ELA) Select Serial Number column to select all NGFW up to 200. For each activation session, you can activate a maximum of 200 NGFW. To activate more, repeat the activation process.
      The following table lists each NGFW type that the SaaS Security Inline license types support:
      NGFW Types
      SaaS Security Inline License Types
      Prod
      Eval
      Trial
      Lab
      Prod (Production)
      Yes
      No
      Yes
      No
      Eval (Evaluation)
      No
      Yes
      No
      No
      Lab
      No
      No
      Yes
      Yes
      When you purchase SaaS Security Inline production subscriptions, the licenses are specific to NGFW models. It's not possible to use licenses created for one model with a different model. On the other hand, when evaluating SaaS Security Inline, Palo Alto Networks provides temporary eval and trial licenses that can be used on any NGFW.
      A NGFW type—prod, eval, and lab—is defined by the NGFW SKU. To see the SKU for a NGFW, log in to your Customer Support Portal account and navigate to AssetsDevices and check the entry for the serial number of your NGFW in the Model Name column. This is the SKU, which indicates the NGFW type as follows:
      • prod SKU—ends with the NGFW model name; for example, PAN-PA-200
      • eval SKU—ends with -E30, which stands for Eval + 30 days; for example, PAN-PA-200-E30
      • lab SKU—ends with -LAB; for example, PAN-PA-200-LAB
    6. Verify your activation selections, read and agree to the terms and conditions, then Activate Subscription.
      (non‑ELA) To check how many subscriptions will be used and how many remain, hover your cursor over the information icon next to Activate Subscriptions on <number> firewalls. A pop-up panel displays the total number of purchased SaaS Security Inline subscriptions you have, how many will be activated in this session, how many were previously activated, and how many have not yet been chosen for activation.
      Depending upon what you onboard, the activation process creates a URL for your SaaS Security web interface and applies SaaS Security Inline licenses to the selected NGFW and links them to your SaaS Security account. During ACE deployment, your NGFW administrator retrieves the license keys from the license server.
    7. Verify that your Strata Logging Service serial number displays on the web interface and indicates Monitoring.
    8. Log in to Strata Cloud Manager and ConfigurationSaaS SecuritySettingsLicense Info, then verify your SaaS Security Inline license.

    © 2026 Palo Alto Networks, Inc. All rights reserved.