Administrator Login using Azure Groups through Cloud Identity Engine

[K.Saucier]

I seem to be finding conflicting info (or none at all) and everything I've tested so far hasn't worked.  

Is it possible to authenticate an Azure user through Cloud Identity Engine and then give them 'administrator' access to Panorama/PanOS based on their Azure group membership without using the Palo Admin-UI Azure Enterprise App?

I have CIE working for GlobalProtect login but, when I assign that same Auth Profile to the Device/Setup/Authentication Profile entry, it fails, seemingly because it's not receiving/mapping group info.  I'm not sure if I can add Groups to the claim information in the "Cloud Authentication Service" Enterprise App (no permissions) so I have to run that up the flagpole but want to know what I'm talking about first.

I'm trying to avoid having to use the Admin-UI app, if possible, since I already have 2 apps in there for the CIE.  Really seems like this should be possible but it's not obvious, if it is.

In the meantime, I thought I could just manually add the users as non-local Administrators using the same Authentication Profile but there is no way (that I see) to enter the full name for the user (domain\user or user@domain.com) as the special characters are invalid.  Since we only have handful of admins and these firewalls are managed by Panorama, I'm fine with just manually creating the users instead of using the group, if that's the easier option.

So:

1. Is it possible to use CIE for Admin Role assignment based on Entra groups without using the Admin-UI Enterprise App?

2. If not, is it possible to use CIE users for Administrator login at all without using the Admin-UI Enterprise App?

3. If you have to use the Admin-UI enterprise app, is it possible to use a single app for multiple firewalls (all different public IP's/URLs)?

If any of those are true, can someone point me towards a 'for dummies' walk through on set up?  I feel like I've spent most of my week trying to get something pretty simple to work and I'm burnt out at this point.  😄 

Thanks!

[Brandon_Wertz]

@K.Saucier I'm not familiar with what Admin-UI Enterprise App is, can you explain this to me?  We don't use SCM we have a "Panorama Managed" Prisma deployment. 

If I understand what you're saying in a normal scenario to log into a FW you need to have the account name (shortname / maybe first.last?) configured as a user and you associate this ID to an auth profile.  

Your issue is that using Entra ID it uses a UPN format username@domain.com, and you're saying the FW doesn't like the @domain being in the user name field?