Disabling CSP Login for Non-Admin Accounts in Cortex XDR with Azure SSO

[ahmad_akbarov]

Hello, I have successfully implemented Single Sign-On (SSO) for Cortex XDR using Azure SSO. Now, I am looking to disable the Customer Support Portal (CSP) login for non-admin accounts. The goal is to ensure that only admin users have the ability to access the CSP, while other users authenticate via SSO. In another hand we are using CSP portal for other Palo Alto products. That's why we can't remove users from CSP. I would appreciate guidance on the best practices for achieving this, particularly any specific configurations or settings within Cortex XDR or Azure AD that need to be adjusted. Additionally, if there are any common pitfalls or considerations to be aware of, that information would be highly valuable. Thank you in advance for your assistance! Cortex XDR

Cortex XDR 

[aspatil]

Hello @ahmad_akbarov ,

To be precise both the scenarios of login are available mutually exclusively which implies that you can either login to Cortex XDR using SSO or CSP if the account is onboarded respectively.  Now if you want to disable the login via CSP, considering the fact that you can't remove the users from CSP, that's not possible. The reason is users onboarded on both CSP and SSO gets accumulated permissions.  

If you are looking forward to segregation of onboarding of uses via SSO or CSP, you might have to consider using different email accounts for login.

Hope this helps!