Testing CIE and user-id mapping question

R.Perez481389 — Thu, 22 Oct 2026 03:48:16 GMT

Hi everyone,

We currently use LDAP on our NGFW, with User-ID mappings coming from the Windows User-ID Agent and GlobalProtect. We’re looking at moving to CIE, as we plan to move away from on-premises AD in the future.

Can CIE be configured alongside our existing LDAP setup so we can initially test it with only a specific Microsoft Entra ID group?

How does user-id mapping work once we move away from LDAP to CIE? Will our existing user-id agent and GP user mapping work as is? Don't want to break our policies which is targeted at AD groups atm.

We’re also looking at configuring MFA through the Palo Alto Networks Enterprise Application in Entra, although we’re considering starting with CIE first.

Thanks!

Re: Testing CIE and user-id mapping question

kiwi — Tue, 27 Oct 2026 14:40:10 GMT

Hi @R.Perez481389

Be careful with userna;e syntax

If your User-ID agent passes 'DOMAIN\jdoe' and your new CIE Entra group expects 'jdoe@domain.com', the firewall won't realize it's the same user, and your policy will break. You'll want to make sure your agent or GlobalProtect is sending correct format across the board before relying on those Entra groups.

Cheers,

topic Re: Testing CIE and user-id mapping question in Cloud Identity Engine Discussions

Testing CIE and user-id mapping question

Re: Testing CIE and user-id mapping question