topic I'd like to know about certificates for GlobalProtect user authentication. in Prisma Access Discussions

I'd like to know about certificates for GlobalProtect user authentication.

y.saitou — Fri, 08 Aug 2025 06:24:40 GMT

Attention: JAPAC TPM team
Hello Team,

Is it possible to apply client certificates to only some user authentications using GlobalProtect depending on the OS type?

My understanding is that if a certificate is specified in GlobalProtect's user authentication settings, it will also be set in other user authentication settings, so I don't think this is possible.

Also, for example, is the following configuration possible?
- Windows devices: SAML authentication
- iOS devices: SAML authentication + certificate authentication

Re: I'd like to know about certificates for GlobalProtect user authentication.

rose42snowden — Wed, 13 Aug 2025 03:57:14 GMT

Yes, it is possible to apply different authentication methods, including client certificates, to GlobalProtect users based on their OS type. GlobalProtect allows you to define multiple client authentication configurations and prioritize them. You can create different authentication profiles and associate them with specific OS types. This enables scenarios like your example: Windows devices using SAML authentication, and iOS devices using SAML authentication plus certificate authentication. The GlobalProtect portal or gateway will then evaluate these configurations in order to determine the appropriate authentication method for each connecting device.

Regards,
Rose S.

Re: I'd like to know about certificates for GlobalProtect user authentication.

y.saitou — Wed, 13 Aug 2025 08:18:48 GMT

@rose42snowden

Thank you for your response.

This has been accepted as a solution.