Content filtering for MAC OSx

[RussMc]

I am trying to finalize my content filtering for our PA 820 rollout. I have the user-ID, group mapping and content filtering rules (By group) working just fine for my windows PC's. Where I am stuck is trying to figure it out for all of our MAC OSx users. None of our MAC's are joined to our domain and I am not sure about adding them at this time. Is there a good source for configuring content filtering in this scenario?

[BPry]

@RussMc,

Do you use on-site Exchange at all? If not, you are essentially left with two options. 

GlobalProtect

GlobalProtect can be used to provide user-id information and your users would essentially just sign-in to GlobalProtect (or configure user certificates and always-on ideally) so that your macOS users map to their AD credentials (assuming you create users for them). 

Authentication Policy

You can setup an authentication policy so that your macOS users are actually authenticated and map to a user properly. Essentially you would just trigger for any unknown user accessing any service and they would need to login via a web form. 

Personally I would give these users GlobalProtect and tell them that they have to use it, or even enforce it across your entire network, because there's less friction and user involvement. You would simply setup a GlobalProtect internal gateway and allow the gateway and the GlobalProtect agent to keep the user-id information in place. This is less friction then authentication policy even if you don't setup an always-on certificate based method and simply have the users utilize on-demand mode. 

[RussMc]

Yes, we have an onsite exchange server. With that said, what are my options there? I do have user ID set up for my exchange server. Should I add my file servers as well? Is this the best choice?