Testing CIE and user-id mapping question

[R.Perez481389]

Hi everyone,

We currently use LDAP on our NGFW, with User-ID mappings coming from the Windows User-ID Agent and GlobalProtect. We’re looking at moving to CIE, as we plan to move away from on-premises AD in the future.

Can CIE be configured alongside our existing LDAP setup so we can initially test it with only a specific Microsoft Entra ID group?

How does user-id mapping work once we move away from LDAP to CIE? Will our existing user-id agent and GP user mapping work as is? Don't want to break our policies which is targeted at AD groups atm.

We’re also looking at configuring MFA through the Palo Alto Networks Enterprise Application in Entra, although we’re considering starting with CIE first.

Thanks!

[kiwi]

Hi @R.Perez481389 

Be careful with userna;e syntax

If your User-ID agent passes 'DOMAIN\jdoe' and your new CIE Entra group expects '[email protected]', the firewall won't realize it's the same user, and your policy will break. You'll want to make sure your agent or GlobalProtect is sending correct format across the board before relying on those Entra groups.

Cheers,