Directory Sync and Prisma access

[MartinE]

I'm considering using Directory Sync for my Panorama-managed Prisma access tenant and would like to clarify certain aspects of using Directory Sync.

- Is there a recommended number of Cloud Identity agent hosts to be deployed?

- Palo Alto's documentation says the certificates generated using the Cloud Identity Engine apps expires 3 months from issuance date and renews automatically for version 1.5.0 and above. Are there specific ports or app-IDs that need to be allowed in policy to ensure automatic renewal?

- In Panorama, when Directory Sync is enabled, a warning message is displayed saying: "After you enable Directory Sync, Prisma access obtains its user and group mapping information from the Directory Sync Service only, and any existing user and group mapping settings will be ignored".

    - Given the above error, does that mean there's the possibility of a temporary outage while the firewalls lose/clear any previous AD group information from LDAP profiles and update their information using Directory Sync?

    - If there are already policies in place that have been configured using the long-form Distinguished Name, will enabling Directory Sync affect the existing configured policies?

Thanks.