>
    Strata Copilot
    Enable Centralized SaaS App Tagging
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. Manage Policy for Unsanctioned SaaS Apps
    4. Enable Centralized SaaS App Tagging
    Download PDF
    SaaS Security

    Enable Centralized SaaS App Tagging

    Table of Contents

    Enable Centralized SaaS App Tagging

    Enable Centralized SaaS App Tagging to synchronize Sanctioned, Tolerated, and Unsanctioned tags with Strata Cloud Manager.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Strata Cloud Manager)
    • Prisma Access (Managed by Strata Cloud Manager)
    • SaaS Security Inline license
    • NGFW or Prisma Access license
    Or any of the following licenses that include the SaaS Security Inline license:
    • CASB-X
    • CASB-PA
    Centralized SaaS Application Tagging is enabled by default for new SaaS Security Inline license activations. The migration steps in this topic apply only to existing tenants.
    Classifying the same app separately in each product leads to conflicting decisions and duplicate effort. Synchronize app tags to classify each app once and see the same classification in every product that uses the shared Application-Tagging snippet in Strata Cloud Manager, such as Activity Insights and AI Access Security™. With synchronization on, tags that you apply in SaaS Security Inline appear in those products, and tags that you apply in those products appear in SaaS Security Inline. Strata Cloud Manager uses the synchronized tags to build App Filters, so your security policy rules reflect your classifications as you update them.
    Only the predefined Sanctioned, Tolerated, and Unsanctioned tags synchronize. Custom tags can't be synchronized.
    SaaS Security Inline identifies apps at the base app level, such as GitHub, Box, and Slack. Strata Cloud Manager products identify apps at the functional App-ID™ level, such as github-base, github-uploading, and github-downloading. This difference determines how tags move:
    • Writing tags—When you tag an app, SaaS Security Inline writes the tag to every functional App-ID for the app. For example, tagging GitHub as Sanctioned tags github-base, github-uploading, and github-downloading as Sanctioned.
    • Reading tags—SaaS Security Inline reads only the tag on the base App-ID. For example, when github-uploading is tagged Sanctioned but github-base has no tag, SaaS Security Inline displays GitHub as Unclassified. Functional App-ID tags remain active in firewall policy. To change the tag for a functional App-ID, use Strata Cloud Manager. Changing the tag for a base App-ID in Strata Cloud Manager doesn't change the tags for its functional App-IDs.
    Before SaaS Security Inline writes any tags, you generate a conflict report that compares your tags with the Application-Tagging snippet. The initial migration follows these rules:
    • If an app has different tags in the two products, the SaaS Security Inline tag overwrites the Strata Cloud Manager tag. For example, an app tagged Unsanctioned in SaaS Security Inline and Sanctioned in Strata Cloud Manager becomes Unsanctioned in both.
    • If an app is explicitly tagged as Unknown in SaaS Security Inline during the migration, the migration removes the predefined tags from the base App-ID and all functional App-IDs in Strata Cloud Manager. This doesn't apply to an app tagged already tagged as Unknown at the time you start the migration.
    • If an app is unclassified in SaaS Security Inline, the migration skips it and leaves the Strata Cloud Manager tag unchanged.
    Enabling synchronization is a one-way action. You cannot undo or disable it.
    After the migration completes, synchronization is bidirectional:
    • From Strata Cloud Manager—A tag that you apply in Activity Insights, AI Access Security, or Strata Cloud Manager appears in SaaS Security Inline within a few minutes.
    • From SaaS Security Inline—A tag that you apply in SaaS Security Inline can take about 15 minutes to appear in Strata Cloud Manager. If a tag change doesn't apply, SaaS Security Inline retries up to three times, about 15 minutes apart.
      If you tag an app as Unknown in SaaS Security Inline, Strata Cloud Manager removes the tag from the base App-ID and all functional App-IDs.
    • Conflicting changes—If you apply different tags to the same app in SaaS Security Inline and Strata Cloud Manager, the last tag that you apply takes priority.
    1. Log in to Strata Cloud Manager.
    2. Associate the Application-Tagging snippet with your Configuration Scopes.
      To push tags to your NGFW or Prisma Access deployment, you must first associate the snippet with the appropriate scope. The snippet identifies apps by their App-ID Cloud Engine (ACE) App-IDs because SaaS Security Inline gives you access to a wider array of apps through ACE. The configuration push fails if a deployment isn't configured to receive App-IDs from ACE.
      1. Select ConfigurationNGFW and Prisma AccessOverview.
      2. Select Configuration ScopeSnippetsApplication-Tagging.
      3. In Snippet Associations, click the settings gear icon.
      4. Select the Configuration Scopes to associate with the Application-Tagging snippet.
        Associate the snippet only with Configuration Scopes that contain NGFWs or Prisma Access deployments with ACE enabled.
        If you tag apps as Sanctioned or Tolerated from the Applications page in Strata Cloud Manager (ConfigurationNGFW and Prisma AccessObjectsApplicationApplications), set the Configuration Scope to the Application-Tagging snippet. Tagging in a different scope causes these problems:
        • The tags shown in AI Access Security, the Activity Insights Applications page, and the Strata Cloud Manager Command Center come from the Application-Tagging snippet, so the tags that policy enforces might differ from the tags shown.
        • If you tag an app in both the Application-Tagging scope and a different scope, tag-based policy enforcement follows an evaluation order that might cause unexpected enforcement behavior.
    3. Select ConfigurationSaaS SecuritySettingsApplication Tagging.
    4. Click Generate Conflict Report.
      Generating the conflict report doesn't change any app tags. When the report is ready, the page shows the number of apps, the number of conflicts, and the number of apps with no conflicts.
    5. Download the CSV report.
    6. Review the app-by-app comparison in the report.
      For each app, the report shows the base App-ID, whether the tags conflict, the tag in Strata Cloud Manager, the tag in SaaS Security Inline, and the Final State, which is the tag that Strata Cloud Manager has after you enable synchronization. It also shows the category, risk score, users, and usage to help you decide which conflicts matter.
    7. (Optional) Resolve the conflicts that you don't want to propagate to Strata Cloud Manager.
      1. Update the tags for the apps in Discovered Apps.
      2. Return to Application Tagging and click Regenerate.
        The report can include apps that have been inactive for more than 90 days and no longer appear in Discovered Apps. You can't update the tags for these apps before the migration, so SaaS Security Inline writes their tags to Strata Cloud Manager when you enable synchronization.
    8. Click Enable.
    9. In the Enable Centralized SaaS Application Tagging dialog, review the summary, and then click Confirm & Enable.
      While the initial migration runs, tag changes that you make in either SaaS Security Inline or Strata Cloud Manager don't synchronize. After the migration completes, all future tag changes synchronize. The migration time depends on the number of app tags being migrated and ranges from 1 hour to multiple days.
    10. After the migration completes, select ConfigurationNGFW and Prisma AccessObjectsApplicationApplications and verify the new tags in Strata Cloud Manager.
      Search for the app and verify that the -base App-ID and all functional App-IDs show the updated tag.

    © 2026 Palo Alto Networks, Inc. All rights reserved.