Update on GlobalProtect's Embedded Web-Views With IE 11 Getting Deprecated by MSFT

[vathreya]

As of June 15, 2022, IE 11 is getting deprecated by Microsoft Edge. Customers are concerned about the use of embedded web-view within GlobalProtect (it relies on IE 11 SDK) well beyond June 15, 2022.

Palo Alto Networks’ GlobalProtect team has tested GlobalProtect’s features that require embedded web-view in 5.1.X, 5.2.X, and 6.0.X release trains.

Customers are advised to review the testing matrix to understand the impact of Microsoft deprecating IE 11 on GlobalProtect’s embedded web-views.

GlobalProtect Version	Windows Version	Use-Case Results
		SAML Authentication in User-logon/On-Demand mode	SAML Authentication in Connect Before Logon	Welcome Page	Help Page	Link in HIP Notification
5.1.X (5.1.11)	Windows 10	Opens in embedded web-view	N/A	Opens in embedded web-view	Opens in user selected default system browser	Opens in IE
5.1.X (5.1.11)	Windows 11 Home	Opens in embedded web-view	N/A	Opens in embedded web-view	Opens in user selected default system browser	Opens in Edge
5.2.X (5.2.12)	Windows 10	Opens in embedded web-view	Opens in embedded web-view	Opens in embedded web-view	Opens in user selected default system browser	Opens in IE
5.2.X (5.2.12)	Windows 11 Home	Opens in embedded web-view	Opens in embedded web-view	Opens in embedded web-view	Opens in user selected default system browser	Opens in Edge
6.0.X	Windows 10	Opens in embedded web-view	Opens in embedded web-view	Opens in user selected system default browser	Opens in user selected system default browser	Opens in IE
6.0.X	Windows 11 Home	Opens in embedded web-view	Opens in embedded web-view	Opens in user selected system default browser	Opens in user selected system default browser	Opens in Edge

Note: This April 2022 article from Microsoft, "Disable Internet Explorer 11," was used as a referenced.

[KengSeng]

After deprecated IE11, does Windows still support the "embedded web-view within GlobalProtect (it relies on IE 11 SDK)"?

If any of the SAML vendor rollout .js script that cannot be interpreted by the "embedded web-view (it relies on IE 11 SDK)" if the customer is using CBL (which not supported using Default Browser), how we are able to fix the issue?

[Ldxiang]

Hi, 

Was running into an issue with the CBL function when using the aws sso as my IDP for the globalprotect authentication. I raised a case to TAC, but was told that they are unable to do anything about this as the update by aws sso team that cause the issue was rolled back. Not sure if Palo alto can confirm that the CBL that is using IE11 SDK can work for all IDP or is this a time bomb that Palo alto is ok with for the customer suffer the consequence.