https://live.paloaltonetworks.com/t5/cloud-identity-engine/testing-cie-and-user-id-mapping-question/m-p/1266719#M108 <P>Hi everyone,</P> <P>We currently use LDAP on our NGFW, with User-ID mappings coming from the Windows User-ID Agent and GlobalProtect. We’re looking at moving to CIE, as we plan to move away from on-premises AD in the future.</P> <P>Can CIE be configured alongside our existing LDAP setup so we can initially test it with only a specific Microsoft Entra ID group?</P> <P>How does user-id mapping work once we move away from LDAP to CIE? Will our existing user-id agent and GP user mapping work as is? Don't want to break our policies which is targeted at AD groups atm.</P> <P>We’re also looking at configuring MFA through the Palo Alto Networks Enterprise Application in Entra, although we’re considering starting with CIE first.</P> <P>Thanks!</P> Thu, 22 Oct 2026 03:48:16 GMT R.Perez481389 2026-10-22T03:48:16Z https://live.paloaltonetworks.com/t5/cloud-identity-engine/testing-cie-and-user-id-mapping-question/m-p/1266719#M108 <P>Hi everyone,</P> <P>We currently use LDAP on our NGFW, with User-ID mappings coming from the Windows User-ID Agent and GlobalProtect. We’re looking at moving to CIE, as we plan to move away from on-premises AD in the future.</P> <P>Can CIE be configured alongside our existing LDAP setup so we can initially test it with only a specific Microsoft Entra ID group?</P> <P>How does user-id mapping work once we move away from LDAP to CIE? Will our existing user-id agent and GP user mapping work as is? Don't want to break our policies which is targeted at AD groups atm.</P> <P>We’re also looking at configuring MFA through the Palo Alto Networks Enterprise Application in Entra, although we’re considering starting with CIE first.</P> <P>Thanks!</P> Thu, 22 Oct 2026 03:48:16 GMT https://live.paloaltonetworks.com/t5/cloud-identity-engine/testing-cie-and-user-id-mapping-question/m-p/1266719#M108 R.Perez481389 2026-10-22T03:48:16Z