Prisma Access Portal config Azure SAML: test config

zGomez — Thu, 28 Apr 2022 09:42:17 GMT

Hi,

I have the following question about Prisma Access Portal authentication, I would like to gradually move my users to use SAML authentication instead of the currently configured profile.

Can I accomplish this by using a group in the Allow List of the authentication profile. So only when you are in the group peform SAML.

Re: Prisma Access Portal config Azure SAML: test config

nikoolayy1 — Thu, 28 Apr 2022 16:21:21 GMT

How will it be known if the user is in the group before the SAML authentication?

The only way I see is after the users have logged into their Globalprotect agents is to have another authentication based on auth policy https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/authentication/authentication-policy but really I think you need to better understand what is needed.

You may check for extra info how to sync user groups from the Azure AD if you don't want to sync from on-prem device or for the Cloud identity engine to connect to a on-prem AD server:

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/configure-user-based-policies-with-prisma-access

How to use Ldap with Azure Ad:

https://live.paloaltonetworks.com/t5/globalprotect-discussions/azuread-group-mapping-for-gp/td-p/334921

A new feature that you can use is SCIM and the cloud identity engine without the need for service connection to the on-prem AD or to sync from on-prem firewall/agent or to pay for the Microsoft Azure Ldap feature:

https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-getting-started/manage-the-cloud-identity-engine/cloud-identity-engine-attributes

https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/sync-scim

topic Re: Prisma Access Portal config Azure SAML: test config in Prisma Access Discussions

Prisma Access Portal config Azure SAML: test config

Re: Prisma Access Portal config Azure SAML: test config