article GlobalProtect: User/Device Context and Compliance in GlobalProtect Articles

GlobalProtect: User/Device Context and Compliance

SpencerMitchell — Mon, 11 Jul 2022 15:30:34 GMT

See how to modify security policy matching based on user identity and device context provided via the GlobalProtect app.

Re: GlobalProtect: User/Device Context and Compliance

Proton951 — Sun, 29 Jun 2025 22:15:44 GMT

Hi,

Struggling to find any documentation related to user based policy configuration. Yours is the closest I could find.

I managed to setup auth for user following documentation here : https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g0000008U48CAE
but there is no mention of how we can add a user authenticated with SAML profile on security policies there.

How do we manage to add an azure saml authenticated user to security policy?

Is it via Cloud Identity engine + User ID?

Kindly help

Re: GlobalProtect: User/Device Context and Compliance

SpencerMitchell — Mon, 30 Jun 2025 16:00:53 GMT

Hello,

I like to think of User-ID as synonymous with all things identity. With this in mind, there are two different aspects of User-ID that we need to configure as it relates to traditional GlobalProtect or Prisma Access: authentication and authorization. Think of authentication as what grants the initial login. A user logs in (is authenticated). Think of authorization as what resources are accessible by a user once they are connected (what they are authorized to access).

In the case of Azure, it can be used both for authentication and authorization. You would configure Azure as an iDP for authentication (see here), and use Azure AD for authorization (see here). If you just set up SAML auth, this is not enough to be able to leverage user/group information in security policy. You also have to setup Azure AD in CIE.

Re: GlobalProtect: User/Device Context and Compliance

Proton951 — Sun, 20 Jul 2025 17:50:23 GMT

Thanks Mitchel,

I have figured it out.
Was able to setup a CIE with Azure Entra then use it as the user accounts on Policies with users authenticated using SAML prepared as in the 1st link I sent.
I will probable come up with a combined doc of it and share its link here aswell so someone that stumbles into it later could save some time

Regards