Prisma Access + GP AzureAD login

[Junedshaikh]

For Global Protect to do SSO against AzureAD, does the workstation needed direct access to AzureAD or does Prisma Access provide route through the system? 

TIA

[emr_1]

GP Agent (=workstation) needs direct access to AzureAD.

Here is good explanation with diagram:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm2oCAC

At first, the global protect user needs to access to prisma access (flow number 1 in diagram)

Then prisma access redirects user to SSO (number 2)

The user will access to SSO (number 3 ..... and this is answer for you)

[Junedshaikh]

Thanks for the response. This question is pertaining to Prisma Access. Therefore If IdP is AzureAD, will step 3,4,5 trverse through Prisma or will use direct to internet to reach the ID Service? 

[emr_1]

step2,3,4 are direct access to IdP