SaaS Security
Manage Enforcement of Rule Recommendations on Strata Cloud Manager
Table of Contents
Expand All
|
Collapse All
SaaS Security Docs
-
-
- Begin Scanning an Amazon S3 App
- Begin Scanning a Bitbucket App
- Begin Scanning a Box App
- Begin Scanning ChatGPT Enterprise App
- Begin Scanning a Cisco Webex Teams App
- Begin Scanning a Confluence App
- Begin Scanning a Confluence Data Center App
- Begin Scanning a Dropbox App
- Begin Scanning a GitHub App
- Begin Scanning a Gmail App
- Begin Scanning a Google Cloud Storage App
- Begin Scanning a Google Drive App
- Begin Scanning a Jira App
- Begin Scanning a Jira Data Center App
- Begin Scanning a Microsoft Azure Storage App
- Begin Scanning a Microsoft Exchange App
- Begin Scanning a Microsoft Teams App
- Begin Scanning Office 365 Apps
- Begin Scanning a Salesforce App
- Begin Scanning a ServiceNow App
- Begin Scanning a ShareFile App
- Begin Scanning a Slack Enterprise App
- Begin Scanning a Slack for Pro and Business App
- Begin Scanning a Workday App
- Begin Scanning a Zendesk App
- Begin Scanning a Zoom App
- Perform Actions on Sanctioned Apps
- API Throttling
- Configure Classification Labels
- Microsoft Labeling for Office 365
- Google Drive Labeling
- Configure Phishing Analysis
- Configure WildFire Analysis
- Fine-Tune Policy
-
- What is an Incident?
- Filter Incidents
- Configure Slack Notification Alerts on Data Security
- Security Controls Incident Details
- Track Down Threats with WildFire Report
- Customize the Incident Categories
- Close Incidents
- Download Assets for Incidents
- View Asset Snippets for Incidents
- Modify Incident Status
- Email Asset Owners
- Generate Reports on Data Security
- Integrate CIE with Data Security
- Search in Data Security
-
-
- View Usage Data for Unsanctioned SaaS Apps
- SaaS Visibility Application Attributes
- How SaaS Security Inline Determines an App's Risk Score
- Identify Risky Unsanctioned SaaS Apps and Users
- Generate the SaaS Security Report
- Filter Unsanctioned SaaS Apps
-
- SaaS Policy Rule Recommendations
- App-ID Cloud Engine
- Guidelines for SaaS Policy Rule Recommendations
- Apply Predefined SaaS Policy Rule Recommendations
- Create SaaS Policy Rule Recommendations
- Enable SaaS Policy Rule Recommendations
- Monitor SaaS Policy Rule Recommendations
- Delete SaaS Policy Rule Recommendations
- Modify Active SaaS Policy Rule Recommendations
- Manage Enforcement of Rule Recommendations on Strata Cloud Manager
- Manage Enforcement of Rule Recommendations on Panorama
- Tag Discovered SaaS Apps
- Apply Tag Recommendations to Sanctioned Apps
- Change Risk Score for Discovered SaaS Apps
- Troubleshoot Issues on SaaS Security Inline
-
-
- Onboarding Overview for Supported SaaS Apps
- Onboard an Aha.io App to SSPM
- Onboard an Alteryx Designer Cloud App to SSPM
- Onboard an Aptible App to SSPM
- Onboard an ArcGIS App to SSPM
- Onboard an Articulate Global App to SSPM
- Onboard an Atlassian App to SSPM
- Onboard a BambooHR App to SSPM
- Onboard a Basecamp App to SSPM
- Onboard a Bitbucket App to SSPM
- Onboard a Bito AI App to SSPM
- Onboard a BlueJeans App to SSPM
- Onboard a Box App to SSPM
- Onboard a Bright Security App to SSPM
- Onboard a Celonis App to SSPM
- Onboard a Cisco Meraki App to SSPM
- Onboard a Claude App to SSPM
- Onboard a ClickUp App to SSPM
- Onboard a Codeium App to SSPM
- Onboard a Cody App to SSPM
- Onboard a Confluence App to SSPM
- Onboard a Contentful App to SSPM
- Onboard a Convo App to SSPM
- Onboard a Couchbase App to SSPM
- Onboard a Coveo App to SSPM
- Onboard a Crowdin Enterprise App to SSPM
- Onboard a Customer.io App to SSPM
- Onboard a Databricks App to SSPM
- Onboard a Datadog App to SSPM
- Onboard a DocHub App to SSPM
- Onboard a DocuSign App to SSPM
- Onboard a Dropbox Business App to SSPM
- Onboard an Envoy App to SSPM
- Onboard an Expiration Reminder App to SSPM
- Onboard a Gainsight PX App to SSPM
- Onboard a GitHub Enterprise App to SSPM
- Onboard a GitLab App to SSPM
- Onboard a Google Analytics App to SSPM
- Onboard a Google Workspace App to SSPM
- Onboard a GoTo Meeting App to SSPM
- Onboard a Grammarly App to SSPM
- Onboard a Harness App to SSPM
- Onboard a Hellonext App to SSPM
- Onboard a Hugging Face App to SSPM
- Onboard an IDrive App to SSPM
- Onboard an Intercom App to SSPM
- Onboard a Jira App to SSPM
- Onboard a Kanbanize App to SSPM
- Onboard a Kanban Tool App to SSPM
- Onboard a Krisp App to SSPM
- Onboard a Kustomer App to SSPM
- Onboard a Lokalise App to SSPM
- Onboard a Microsoft 365 Copilot App to SSPM
- Onboard a Microsoft Azure AD App to SSPM
- Onboard a Microsoft Exchange App to SSPM
- Onboard a Microsoft OneDrive App to SSPM
- Onboard a Microsoft Outlook App to SSPM
- Onboard a Microsoft Power BI App to SSPM
- Onboard a Microsoft SharePoint App to SSPM
- Onboard a Microsoft Teams App to SSPM
- Onboard a Miro App to SSPM
- Onboard a monday.com App to SSPM
- Onboard a MongoDB Atlas App to SSPM
- Onboard a MuleSoft App to SSPM
- Onboard a Mural App to SSPM
- Onboard a Notta App to SSPM
- Onboard an Office 365 App to SSPM
- Onboard Office 365 Productivity Apps to SSPM
- Onboard an Okta App to SSPM
- Onboard an OpenAI App to SSPM
- Onboard a PagerDuty App to SSPM
- Onboard a Perplexity App to SSPM
- Onboard a Qodo App to SSPM
- Onboard a RingCentral App to SSPM
- Onboard a Salesforce App to SSPM
- Onboard an SAP Ariba App to SSPM
- Onboard a ServiceNow App to SSPM
- Onboard a Slack Enterprise App to SSPM
- Onboard a Snowflake App to SSPM
- Onboard a SparkPost App to SSPM
- Onboard a Tableau Cloud App to SSPM
- Onboard a Tabnine App to SSPM
- Onboard a Webex App to SSPM
- Onboard a Weights & Biases App to SSPM
- Onboard a Workday App to SSPM
- Onboard a Wrike App to SSPM
- Onboard a YouTrack App to SSPM
- Onboard a Zendesk App to SSPM
- Onboard a Zoom App to SSPM
- Onboarding an App Using Azure AD Credentials
- Onboarding an App Using Okta Credentials
- Register an Azure AD Client Application
- View the Health Status of Application Scans
- Delete SaaS Apps Managed by SSPM
-
-
-
- New Features Introduced in December 2024
- New Features Introduced in November 2024
- New Features Introduced in October 2024
- New Features Introduced in August 2024
- New Features Introduced in July 2024
- New Features Introduced in June 2024
- New Features Introduced in May 2024
- New Features Introduced in April 2024
- New Features Introduced in March 2024
- New Features Introduced in January 2024
-
- New Features Introduced in November 2023
- New Features Introduced in October 2023
- New Features Introduced in September 2023
- New Features Introduced in August 2023
- New Features Introduced in July 2023
- New Features Introduced in June 2023
- New Features Introduced in May 2023
- New Features Introduced in April 2023
- New Features Introduced in March 2023
- New Features Introduced in January 2023
-
- New Features Introduced in December 2021
- New Features Introduced in October 2021
- New Features Introduced in September 2021
- New Features Introduced in August 2021
- New Features Introduced in July 2021
- New Features Introduced in June 2021
- New Features Introduced in May 2021
- New Features Introduced in March 2021
- New Features Introduced in January 2021
Manage Enforcement of Rule Recommendations on Strata Cloud Manager
Learn how to import, update, and remove policy rule recommendations on NGFW and Prisma Access (Managed by Strata Cloud Manager).
Where Can I Use This? | What Do I Need? |
---|---|
|
Or any of the following licenses that include the SaaS Security Inline license:
|
When a SaaS Security administrator authors and submits SaaS policy
rule recommendations, the Web Security or Data Security administrator imports those
new rule recommendations and updates or removes those same rule recommendations as
the SaaS Security administrator makes changes to them. Before you begin,
review the SaaS Security
access privileges for your Web Security or
Data Security administrator to ensure they can successfully manage enforcement of
rule recommendations. You can also troubleshoot issues after implementing new policy rules or
modifying existing ones.
SaaS policy rule recommendations are based on a combination of
apps, users and groups, categories, activities, device posture, and data profiles.
The import process automatically creates the necessary objects, including an Application Group
for the apps in the SaaS policy rule recommendation. The name of the Application
Group is derived from the Rule Name that the SaaS Security administrator assigned to the SaaS policy rule recommendation.
As guidelines outline, if the SaaS Security administrator updates a rule recommendation, for example by
adding or removing apps, you also need to update the rule recommendation. If the SaaS Security administrator submits new or updated Application Groups, HIP
Profiles, or tags, Prisma Access (Managed by Strata Cloud Manager) automatically creates or updates those
objects. You can manually apply the updates as outlined below or bypass such updates
by enabling automatic updates.
For audit purposes, all imports and updates and deletions of existing SaaS policy
rules recommendations are logged along with the administrator who took the action.
When an import fails, the log indicates the reason for the failure. Web Security
Administrators and Security Administrators can view such logs.
Alternatively, SaaS Security administrators can create
Internet Access rules instead of policy
rule recommendations to simplify policy rule creation for SaaS app security using
snippets and folder configurations. This allows you to
enforce consistent SaaS app security regardless of the enforcement point, eliminate
policy implementation delay, and reduce the risk of misconfigurations. This
streamlined workflow enables you to fully utilize the SaaS Security Inline
capabilities, achieve a stronger security posture for your SaaS environment all
while reducing the managerial overhead of implementing new Security policy rules for
your SaaS apps.
- Enable Automatic Updates for Policy Rule Recommendations
- Update Imported Policy Rule Recommendations
- Remove Deleted Policy Rule Recommendations
Import New SaaS Policy Rule Recommendations on Strata Cloud Manager
Learn how to import new SaaS policy rule recommendations on Strata Cloud Manager to gain
visibility into and control of the apps in the rule.
- Log in to Strata Cloud Manager.
- If you have not already, associate the predefined SAAS-Inline-Pol-Recommendations snippet with one or more folders, NGFW, and Prisma Access tenants.Use snippets to standardize a common base configuration for a set of NGFW, and Prisma Access tenants. This allows you to quickly onboard new devices with a known good configuration and reduces the time required to onboard a new device. Additionally, this also allows you to quickly apply the same SaaS app security enforcement to multiple NGFW, and Prisma Access tenants.Use the predefined SAAS-Inline-Pol-Recommendations snippet to simplify management of your SaaS Security Inline Policy Recommendations.
- Click the Configuration Scope and select SnippetsSAAS-Inline-Pol-Recommendations.
- Select ManageConfigurationNGFW and Prisma AccessSecurity ServicesInternet SecurityPolicy Recommendations.
- In New SaaS Rule Recommendations, locate the policy recommendation that you want to import, then select ActionsImport.
- In the Import dialog and select the Rule Order to indicate where to position the new policy in the rulebase, then Import.If you specify a policy rule name that already exists in the rulebase, the imported rule overwrites the existing rule.The policy recommendation that you imported displays as an Imported policy in Imported SaaS Rule Recommendations. If your import fails, click the Last import failed link to understand why the import failed, then resolve the failure.
- Click Push Config.
- (Optional) Enable automatic updates.
Enable Automatic Updates for SaaS Policy Rule Recommendations on Strata Cloud Manager
Learn how to enable automatic updates to rule recommendations on Strata Cloud Manager.
Enable automatic updates to automatically apply rule recommendation changes that the SaaS Security administrator requests to the rulebase. Doing so ensures
that you don’t need to continuously monitor changes to existing rule
recommendations. If you don’t enable automatic updates, Prisma Access (Managed by Strata Cloud Manager)
continues to automatically pull the updates for you to review and manually
import.
When you have automatic updates enabled, updates to existing rule recommendations display as
Updates imported in Imported SaaS Rule
Recommendations. Use the Last update failed
link to help you resolve any failures.
- Log in to Strata Cloud Manager.
- If you have not already, associate the predefined SAAS-Inline-Pol-Recommendations snippet with one or more folders, NGFW, and Prisma Access tenants.Use snippets to standardize a common base configuration for a set of NGFW, and Prisma Access tenants. This allows you to quickly onboard new devices with a known good configuration and reduces the time required to onboard a new device. Additionally, this also allows you to quickly apply the same SaaS app security enforcement to multiple NGFW, and Prisma Access tenants.Use the predefined SAAS-Inline-Pol-Recommendations snippet to simplify management of your SaaS Security Inline Policy Recommendations.
- Select ManageConfigurationNGFW and Prisma AccessSecurity ServicesInternet SecurityPolicy Recommendations.
- Click the Configuration Scope and select SnippetsSAAS-Inline-Pol-Recommendations.
- In Imported SaaS Rule Recommendations, toggle Enable Automatic Updates to the on position.If you’ve already imported the rule recommendation, the SaaS admin’s update to the policy rule recommendation is automatically loaded into Imported SaaS Rule Recommendations and is pending approval.
Update Imported SaaS Policy Rule Recommendations on Strata Cloud Manager
Learn how to update imported SaaS policy rule recommendations on Strata Cloud Manager.
You can monitor the availability
of updates to rule recommendations from OverviewPolicy Recommendations.

- Log in to Strata Cloud Manager.
- If you have not already, associate the predefined SAAS-Inline-Pol-Recommendations snippet with one or more folders, NGFW, and Prisma Access tenants.Use snippets to standardize a common base configuration for a set of NGFW, and Prisma Access tenants. This allows you to quickly onboard new devices with a known good configuration and reduces the time required to onboard a new device. Additionally, this also allows you to quickly apply the same SaaS app security enforcement to multiple NGFW, and Prisma Access tenants.Use the predefined SAAS-Inline-Pol-Recommendations snippet to simplify management of your SaaS Security Inline Policy Recommendations.
- Select ManageConfigurationNGFW and Prisma AccessSecurity ServicesInternet SecurityPolicy Recommendations.
- Click the Configuration Scope and select SnippetsSAAS-Inline-Pol-Recommendations.
- In Imported SaaS Rule Recommendations, locate the rule recommendations that have updates as indicated by the Status, then click ActionsUpdate icon.
- Update available—SaaS administrator updated the rule recommendation and is pending your approval.
- Update available (This rule will be removed)—SaaS administrator deleted the rule recommendation and is pending your approval.
The policy recommendation that you updated displays as an Imported policy in Imported SaaS Rule Recommendations. Use the Last update failed link to help you resolve any failures.If you want to import all updates for all existing rule recommendations, click Sync instead. - Click Push Config.
Remove Deleted SaaS Policy Rule Recommendations on Strata Cloud Manager
Manage your rulebase on Strata Cloud Manager by removing deleted SaaS policy rule
recommendations.
When a SaaS Security administrator authors and submits SaaS policy
rule recommendations, the Web Security or Data Security administrator imports those
rule recommendations and the Security administrator pushes those rule
recommendations to gain visibility into and control of the applications in the SaaS
policy recommendation. Before you begin, learn about the Hub roles that enable administrators to
collaborate on SaaS Security.
As the guidelines outline, if the SaaS Security administrator deletes the rule recommendation, you also need
to delete that rule recommendation. When you delete an imported rule
recommendation:
- The policy is deleted from the rulebase.
- The HIP Profile and all associated objects are deleted from the configuration if you'ren’t using them in other policy rules.
- Application Group is deleted from the configuration.
- Log in to Strata Cloud Manager.
- If you have not already, associate the predefined SAAS-Inline-Pol-Recommendations snippet with one or more folders, NGFW, and Prisma Access tenants.Use snippets to standardize a common base configuration for a set of NGFW, and Prisma Access tenants. This allows you to quickly onboard new devices with a known good configuration and reduces the time required to onboard a new device. Additionally, this also allows you to quickly apply the same SaaS app security enforcement to multiple NGFW, and Prisma Access tenants.Use the predefined SAAS-Inline-Pol-Recommendations snippet to simplify management of your SaaS Security Inline Policy Recommendations.
- Select ManageConfigurationNGFW and Prisma AccessSecurity ServicesInternet SecurityPolicy Recommendations.
- Click the Configuration Scope and select SnippetsSAAS-Inline-Pol-Recommendations.
- In Imported SaaS Rule Recommendations, locate the rule recommendations that the SaaS administrator deleted as indicated by the Removed Status, then click ActionsDelete icon.
- Update available—SaaS administrator updated the rule recommendation and is pending your approval.
- Update available (This rule will be removed)—SaaS administrator deleted the rule recommendation and is pending your approval.
The policy recommendation that you deleted no longer displays in Imported SaaS Rule Recommendations. If your deletion fails, click the Last import failed link to understand why the import failed, then resolve the failure. - Click Push Config.