When a SaaS Security administrator authors and submits SaaS policy rule recommendations, the Web Security or Data Security administrator imports those new rule recommendations and updates or removes those same rule recommendations as the SaaS Security administrator makes changes to them. Before you begin, review the SaaS Security access privileges for your Web Security or Data Security administrator to ensure they can successfully manage enforcement of rule recommendations. You can also troubleshoot issues after implementing new policy rules or modifying existing ones.

SaaS policy rule recommendations are based on a combination of apps, users and groups, categories, activities, device posture, and data profiles. The import process automatically creates the necessary objects, including an Application Group for the apps in the SaaS policy rule recommendation. The name of the Application Group is derived from the Rule Name that the SaaS Security administrator assigned to the SaaS policy rule recommendation.

As guidelines outline, if the SaaS Security administrator updates a rule recommendation, for example by adding or removing apps, you also need to update the rule recommendation. If the SaaS Security administrator submits new or updated Application Groups, HIP Profiles, or tags, Prisma Access (Managed by Strata Cloud Manager) automatically creates or updates those objects. You can manually apply the updates as outlined below or bypass such updates by enabling automatic updates.

For audit purposes, all imports and updates and deletions of existing SaaS policy rules recommendations are logged along with the administrator who took the action. When an import fails, the log indicates the reason for the failure. Web Security Administrators and Security Administrators can view such logs.

Alternatively, SaaS Security administrators can create Internet Access rules instead of policy rule recommendations to simplify policy rule creation for SaaS app security using snippets and folder configurations. This allows you to enforce consistent SaaS app security regardless of the enforcement point, eliminate policy implementation delay, and reduce the risk of misconfigurations. This streamlined workflow enables you to fully utilize the SaaS Security Inline capabilities, achieve a stronger security posture for your SaaS environment all while reducing the managerial overhead of implementing new Security policy rules for your SaaS apps.