Setup Prisma SASE App – Multi-Tenant

1. Access your ServiceNow Instance.

   1. Log in to your ServiceNow instance as an administrator.
   2. Select Prisma SASE APP for ServiceNowApp SetupBasic Settings.
2. Configure Prisma SASE Connections.

   Prisma SASE connection configuration includes configuring the Prisma SASE platform credentials, application gateway URLs used to connect to Prisma SASE, connection alias.

   Although you can have multiple credentials and connections, only one credential and connection will be active at a time.

   1. Select Configure Prisma SASE Connections.
   2. Create Credentials.

      Credentials are details of the service account created in the Strata Cloud Manager. This credential will be used by the ServiceNow app to connect securely with Prisma SASE.

      1. Select Create CredentialsConfigureNew.
      2. Specify the TSG ID, Client ID, and Client Secret.
      3. Submit the configuration.
      4. Mark as Complete.

   3. (Optional) Create Connection Alias.

      A connection alias is a defined label that represents a specific combination of credentials and connection details. It allows ServiceNow integrations to reference the alias rather than using the credentials and connection information directly, providing consistency and simplifying configuration management.

      A default connection alias, Prisma SASE API, is available. If you choose to use this default alias, click Mark as Complete and proceed to the next step.

      If you want to create a new connection alias, perform the following:

      1. Select Create Connection AliasConfigureNew.
      2. Specify the following:
         • Name- Connection alias name.
         • Type- Connection and Credentials.
         • Connection type- HTTP.
      3. Submit the configuration.
      4. Mark as Complete.

   4. Create Connections.

      1. Select Create Connection AliasConfigureNewHTTP(s) Connection.
      2. Specify the following:
         • • Name -Connection name.
           • Credential and Connection alias- Search and select the credential and connection alias that you created in the previous steps.
           • Connection URL- Prisma SASE API gateway URL.
      3. Submit the configuration.
      4. Mark as Complete.

3. Configure ServiceNow Credentials.

   These are the credentials that will be used by the Prisma SASE to securely connect to the ServiceNow instance and access Incidents, Alerts, and tickets.

   Although you can have multiple ServiceNow credentials, only one credential will be active at a time.

   1. Select Configure ServiceNow CredentialsConfigureNew.
   2. Specify the Name, ServiceNow Instance UserName, and ServiceNow Instance Password.
   3. Submit the configuration.
   4. Mark as Complete.

4. Customize Configuration.

   Perform the following steps to set the Tenant Service Group Mapping to active. This process populates the appropriate domains, initiates domain-separated configuration for tenant-specific data management, and automatically creates a company for each domain.

   1. Select Prisma SASE Customized Configuration ConfigureTenant Service Group Mapping.
   2. Select Active.
   3. Update the configuration.
5. Execute Scheduled Jobs.

   By default, the App includes scheduled jobs to synchronize the data between the Prisma SASE and ServiceNow. These jobs are configured to be executed on demand. However, you can also modify the job configuration to automatically run them periodically.

   Execute the following jobs:

   • Scheduled Job for Prisma SASE Multitenancy Information- This job is used to fetch the multitenancy data from the Prisma SASE and automatically create the corresponding domains in ServiceNow.

   • Sync Incident Settings Metadata- This job updates the Incident Settings Metadata, including Category, Subcategory, and Code Mapping values, which are required for Notification Profile configuration.

   to fetch the multitenancy data from the Prisma SASE and automatically create the corresponding domains in ServiceNow.

   1. Select Configure Scheduled JobConfigure.
   2. Select the job you need to execute manually.
   3. Select Active.
   4. Click Execute Now.

   Ensure to mark Steps 2 to 5 as complete or skip them. Only when the completion status reaches 100%, the connection between the ServiceNow instance and Prisma SASE will be established.
6. After you set up the app, you need to create a user for the tenant and assign the required roles and permissions. This account will be used by the tenant to log into the ServiceNow instance.

   1. Create a new user for the root tenant.
      1. Select OrganizationUsersNew.
      2. Specify the Name, User ID, and Email.
      3. Search and select the Company. The company name matches the domain or tenant name. Each company represents a tenant organization and ensures the segregation of data and processes.
      4. Submit to create a new user.
   2. Assign roles.
      1. Search for the newly added user by name.
      2. Select the user.
      3. Select RolesEdit.
      4. Search and add the roles based on the user's responsibility.
         For details about the roles and their permissions, see Roles and Permissions
      5. Save the user.