SaaS Security Administrator's Guide
    : Create a Plugin Access Control Policy
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. SaaS Security Administrator's Guide
    4. SaaS Security Posture Management
    5. Remediate Posture Security Risks
    6. Take Action on Third-Party Plugins
    7. Create a Plugin Access Control Policy
    Download PDF

    SaaS Security Administrator's Guide

    Create a Plugin Access Control Policy

    Table of Contents

    Create a Plugin Access Control Policy

    Create Plugin Access Control policies to take action when users install third-party plugins that you do not want to allow in your environment.
    Create Plugin Access Control policies to take action when users install third-party plugins that you do not want to allow in your environment. Although you can revoke access to a plugin from the 3rd Party Plugins page, that does not prevent a user from subsequently installing the same plugin. By creating a Plugin Access Control policy, SSPM will periodically scan marketplace apps for certain plugins and will automatically take action on your behalf. Depending on the marketplace app, SSPM might be able to automatically revoke access. If not, SSPM can notify you in the following ways so you can revoke access to the plugin.
    • SSPM can create a task in an issue tracking system.
    • SSPM can send an email notification to the user who created the policy.
    • SSPM can, by using an incoming webhook, send notifications to a channel in Slack or Microsoft Teams.
    After SSPM notifies you that a plugin is installed, you can then take action to remove the plugin from your environment.
    In addition to creating these polices to take action when users install third-party plugins, you can create Application Settings policies to scan specified application settings to detect misconfigured settings.
    1. To navigate to the Security Configurations view, select SSPMSecurity Configurations.
    2. Select the Policies tab.
    3. Add Policy Plugin Access Control Policy.
      A Policy Creation page for a plugin access control policy opens.
    4. On the Basic Information tab, specify the following information about your policy:
      • The Name of the policy. This name will appear in the list of policies on the Policies tab of the Security Configurations page. For this reason, specify a meaningful name that will be distinguishable from the other policies in the list.
      • A Description of the policy. After you create the policy, this description will appear on the details page for the policy. Describe the purpose of the policy for administrators who might be viewing the policy later.
    5. Go to the Next tab of the Policy Creation page to identify the plugins to be affected by the policy.
    6. On the Plugins tab, select one or more of the third-party plugins in the table.
      These are the third-party plugins that you do not want to allow in your environment. When the policy is enabled, SSPM will scan the marketplace apps at regular intervals to determine if the selected third-party plugins are installed.
      To identify high-risk plugins, examine the information in the Severity and Risk columns of the table. The Severity is based on the marketplace app's scopes that were granted to the third-party plugin. The greater the access to the marketplace app's data and actions, the higher the Severity. The Risk column shows the application's risk score. The risk score is between 1 (low risk) and 5 (high risk) and is calculated from over 55 application attributes including compliance attributes, security and privacy attributes, identity access management attributes, and, if applicable, GenAI attributes.
      To help you locate the third-party plugins you want to add to the policy, you can Add Filter to the table. You can filter the table by third-party plugin attributes such as the application name, marketplace, and severity.
    7. Go to the Next tab of the Policy Creation page to configure the policy actions.
    8. On the Policy Actions tab, select one or more actions.
      These are the actions that you want SSPM to take when it detects a third-party plugin identified in the policy. The action will apply to all selected third-party plugins for a particular marketplace. Depending on the marketplace app and other factors, the following actions are available:
      • Revoke / Block: Depending on the level of permission that SSPM has to the marketplace app, and on the capabilities that the marketplace app's API provides, SSPM can automatically revoke user access to the plugin. The Policy Actions page indicates whether this action is available for the marketplace. If the Revoke / Block action is not available, you can instead log in to the marketplace app's administration console, and follow its documentation to remove the plugin.
      • Ticket: If you are using the Jira or ServiceNow issue tracking system to manage your team's tasks, SSPM can create a tickets in the issue tracking system about the plugins that need to have their access revoked. Based on the information in the ticket, you can revoke user access to the plugin. You can revoke access to the plugin either from the 3rd Party Plugins page (if supported by the marketplace app), or from the marketplace app's administration console. To configure SSPM for ticket creation, you must have linked SSPM to a Jira or ServiceNow instance. From the Configure Ticketing area, you can select the issue tracking system and specify information such as the type and instance of the issue tracking system, and the type of ticket to create.
      • Notify: SSPM can send information about the plugins that need to have their access revoked to an email address. If you have configured webhooks in SSPM to send notifications to a channel in Slack or Microsoft Teams, SSPM can also send notifications to one of those webhooks. Based on the information in the notification, you can revoke user access to the plugin. You can revoke access to the plugin either from the 3rd Party Plugins page (if supported by the marketplace app), or from the marketplace app's administration console. SSPM sends the email notifications to the email address of the user who created the plugin access control policy. SSPM sends webhook notifications to the webhook you select in the Configure Notification area.
    9. Go to the Next tab of the Policy Creation page to view a summary of the policy.
    10. Review the information on the Summary page to verify that the information is correct. If necessary, you can Edit the information.
      By default, the policy is enabled, which means the SSPM will scan the marketplace apps at regular intervals to determine if any of the third-party plugins that you identified are installed. If any are installed, SSPM will perform the actions you specified. If you do not want to enable the policy at this time, position the Enable Policy toggle to the off position.
      When you are sure that this is the policy that you want to create, Save the policy.
    11. After you have reviewed the information on the Summary page and are sure that this is the policy that you want to create, Save the policy.

    © 2025 Palo Alto Networks, Inc. All rights reserved.