Cloud Identity Engine Azure AD as a service

markk96 — Wed, 24 Aug 2022 19:50:34 GMT

I am confused about Cloud Identity,, on how and what to use for Azure AD as a service to map IP's to username when users login to Azure AD from their surface device.

Re: Cloud Identity Engine Azure AD as a service

nikoolayy1 — Wed, 09 Nov 2022 09:55:13 GMT

Basically you are using SAML IdP that is the Azure AD and the cloud identity engine is the SAML SP and it gets the Azure data like user and ad group , email address etc. from the Azure AD after the user authenticates on it like SAML assertions that are insterted in the User browser request after the Azure AD authenticates the user and returns them to Prisma Acccess 🙂

https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-getting-started/authenticate-users-with-the-cloud-identity-engine/configure-an-identity-provider-in-the-cloud-identity-engine/configure-azure-as-an-idp-in-the-cloud-identity-engine

After you have registered the Application that will be used for SAML in the Azure AD portal you can even select what data will be returned to Prisma Access:

Also you can add as a bonus SCIM for extra sync between Azure AD and CIE as SAML is too static and if you block a user on Azure AD it will take time before he is blocked on the Prisma Access but SCIM solves this.

https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-getting-started/choose-directory-type/configure-a-cloud-based-directory/configure-scim-connector-for-the-cloud-identity-engine

topic Cloud Identity Engine Azure AD as a service in Cloud Identity Engine Discussions

Cloud Identity Engine Azure AD as a service

Re: Cloud Identity Engine Azure AD as a service