topic Re: Using Cloud IDentity Engine to enforce group-based policies in Azure AD in Prisma Access Discussions

Using Cloud IDentity Engine to enforce group-based policies in Azure AD

PA_nts — Thu, 18 Jan 2024 10:15:56 GMT

Hi All,

Question on retrieving user-group mappings only, using Cloud Identity Engine to enforce group-based policies.

So i have this setup at the moment:
Panorama managed FWs in Azure with Global protect (works)
The FWs use SAML currently for authenticating GP users against Azure AD (works)

Additionally, what I want to achieve is the following.
To setup group-based policies on the FW to allow for instance:

Source: Zone - GP_VPN
user group: GROUP_SALES can access Zone TRUST - 10.10.10.0/24 on https only

Source: Zone - GP_VPN
user group: GROUP_HR can access zone TRUST 10.20.20.0/24 on https only

Source: Zone - GP_VPN
user group: GROUP_Accounts can access zone TRUST 10.30.30.0/24 on https only

So I only want the FW to enforce Azure AD-Group based policies for users connecting via Globalprotect.

So from what I can tell, this is possible with Cloud Identity Engine.

questions:
will this work and not affect my current SAML config.
do i need to enable/configure user-id (not enabled atm anywhere)

so looking at this doc from PAN, it seems to do what I want to do.. but just need a second pair of eyes please.

https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-getting-started/authenticate-users-with-the-cloud-identity-engine/configure-the-cloud-identity-engine-as-a-mapping-source-on-the-firewall

thanks in adv

Re: Using Cloud IDentity Engine to enforce group-based policies in Azure AD

reaper — Wed, 31 Jan 2024 08:44:48 GMT

you need to ensure the GP_VPN zone has user-id enabled, that ensures user-ids are mapped and logged etc

afterwards you can connect CIE, without causing impact, this will simply load all your available groups to the firewall

once that's done you can start adding groups to security rules

Re: Using Cloud IDentity Engine to enforce group-based policies in Azure AD

PA_nts — Wed, 31 Jan 2024 11:07:13 GMT

Awesome thanks..

Re: Using Cloud IDentity Engine to enforce group-based policies in Azure AD

PA_nts — Fri, 01 Mar 2024 11:06:01 GMT

quick update..

CIE app activated, Azure config done, CIE can connect and i can see user groups/names etc within CIE App.. all good.

however stuck on the FWs..

i have panorama with managed FWs..

in the template group i configured CIE with the tenant and domain info (auto retrieved so tells me it connects ok) - changes committed.

In Panorama, if i go into a security rule on my device group policy, i am unable to pull the user details..

however If i change to the FW context and create a dummy rule, then i am able to see the users/groups pulled from CIE

so not sure why this is.

I have configured CIE profile only in panorama>device>User Identification> Cloud Identity Engine

i followed this doc. but stuck at step 8 😞

any ideas?

thanks