On-Prem Firewall & Cloud Identity Engine for SAML GP

krishna.c — Wed, 24 Jun 2026 09:48:24 GMT

Hi folks,

I have a question regarding GlobalProtect authentication using SAML and Cloud Identity Engine (CIE).

Current setup:

Users authenticate to Prisma Access using SAML.
The Identity Provider is Microsoft Entra ID.
Cloud Identity Engine (CIE) is already integrated with Entra ID and working successfully for Prisma Access users.

What I would like to achieve:

Deploy GlobalProtect on an on-premises Palo Alto firewall.
Reuse the existing CIE tenant and Entra ID integration rather than creating a separate SAML integration directly between the firewall and Entra ID.

I came across the following documentation:

https://docs.paloaltonetworks.com/identity/cloud-identity-engine/identify-users-and-devices-with-cie/redistribute-identification-information-from-ngfws-to-the-cloud/configure-the-cloud-identity-engine-as-a-mapping-source/configure-the-cloud-identity-engine-as-a-mapping-source-on-the-firewall

My understanding is that CIE is already acting as the identity source and authentication for Prisma users is currently occurring through Entra ID via SAML. Therefore, if I integrate my on-prem firewall with the same CIE tenant and use the corresponding authentication profile for GlobalProtect, would the firewall be able to leverage the existing SAML authentication flow through CIE?

Or is a separate SAML application/integration between the on-prem firewall and Entra ID still required for GlobalProtect authentication?

Has anyone implemented a similar design or can clarify whether this architecture is supported?

topic On-Prem Firewall & Cloud Identity Engine for SAML GP in General Topics

On-Prem Firewall & Cloud Identity Engine for SAML GP