topic Prisma Access + GP AzureAD login in GlobalProtect Discussions

Prisma Access + GP AzureAD login

Junedshaikh — Mon, 03 Apr 2023 16:59:23 GMT

For Global Protect to do SSO against AzureAD, does the workstation needed direct access to AzureAD or does Prisma Access provide route through the system?

TIA

Re: Prisma Access + GP AzureAD login

emr_1 — Tue, 04 Apr 2023 01:27:34 GMT

GP Agent (=workstation) needs direct access to AzureAD.

Here is good explanation with diagram:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm2oCAC

At first, the global protect user needs to access to prisma access (flow number 1 in diagram)

Then prisma access redirects user to SSO (number 2)

The user will access to SSO (number 3 ..... and this is answer for you)

Re: Prisma Access + GP AzureAD login

Junedshaikh — Tue, 11 Apr 2023 20:41:17 GMT

Thanks for the response. This question is pertaining to Prisma Access. Therefore If IdP is AzureAD, will step 3,4,5 trverse through Prisma or will use direct to internet to reach the ID Service?

Re: Prisma Access + GP AzureAD login

emr_1 — Wed, 12 Apr 2023 00:56:34 GMT

step2,3,4 are direct access to IdP