Pulling in users directly from ADDS?

[cra1901]

I have a requirement to pull in our users from Azure AD (or AADDS depending on the solution) into Prisma Cloud in order to create policy rules based on the source user/group but I'm unsure as to which method I would need to set this up? (Device\LDAP, Panorama\LDAP or Cloud Identity Engine - perhaps there's more than one way?!)

We do not have a Windows domain and therefore have no on-prem DC to connect to. Has anyone else got this set up that could point me in the right direction?

TIA

[NikolayDimitrov · Accepted solution]

There is a guide for this:

https://www.paloaltonetworks.com/resources/guides/prisma-access-for-users-deployment-guide

I think also SAML is a nice option where the Prisma Access will be SP and Azure AD will be the IdP.

https://www.consigas.com/best-practice/remote-access-authentication/

[cra1901]

Thank you for your help

[NikolayDimitrov]

This is not for Azure AD but it shows how to extract the SAML atributes for user and group membership:

https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Palo-Alto-Networks-GlobalProtect.h...

[cra1901]

Hi Nikolay - just to clarify, I'd like to import Azure AD groups into Palo Alto so that I can create rules based on them. E.g. create a policy rule that allows the Marketing dept to connect to an external application. Do the instuctions you have given me go through the steps to enable this?

Thanks.