On-Prem Firewall & Cloud Identity Engine for SAML GP

krishna.c — Wed, 24 Jun 2026 09:48:24 GMT

Hi folks,

I have a question regarding GlobalProtect authentication using SAML and Cloud Identity Engine (CIE).

Current setup:

Users authenticate to Prisma Access using SAML.
The Identity Provider is Microsoft Entra ID.
Cloud Identity Engine (CIE) is already integrated with Entra ID and working successfully for Prisma Access users.

What I would like to achieve:

Deploy GlobalProtect on an on-premises Palo Alto firewall.
Reuse the existing CIE tenant and Entra ID integration rather than creating a separate SAML integration directly between the firewall and Entra ID.

I came across the following documentation:

https://docs.paloaltonetworks.com/identity/cloud-identity-engine/identify-users-and-devices-with-cie/redistribute-identification-information-from-ngfws-to-the-cloud/configure-the-cloud-identity-engine-as-a-mapping-source/configure-the-cloud-identity-engine-as-a-mapping-source-on-the-firewall

My understanding is that CIE is already acting as the identity source and authentication for Prisma users is currently occurring through Entra ID via SAML. Therefore, if I integrate my on-prem firewall with the same CIE tenant and use the corresponding authentication profile for GlobalProtect, would the firewall be able to leverage the existing SAML authentication flow through CIE?

Or is a separate SAML application/integration between the on-prem firewall and Entra ID still required for GlobalProtect authentication?

Has anyone implemented a similar design or can clarify whether this architecture is supported?

Re: On-Prem Firewall & Cloud Identity Engine for SAML GP

nikoolayy1 — Fri, 24 Jul 2026 07:34:12 GMT

CIE acts like a middle man so yes it will work with Microsoft Entra ID . CIE needs to also be connected to Entra ID as to then collect user groups for authorization purposes as not only the user to be allowed but to have rules to allow specific AD groups.

Set Up a SAML 2.0 Authentication Type

Set Up an Entra ID Directory

Authenticate Users with the Cloud Identity Engine

Configure the Cloud Identity Engine as a Mapping Source

topic Re: On-Prem Firewall & Cloud Identity Engine for SAML GP in Cloud Identity Engine Discussions

On-Prem Firewall & Cloud Identity Engine for SAML GP

Re: On-Prem Firewall & Cloud Identity Engine for SAML GP