Prisma Access - Security Group pull

[Junedshaikh]

How do I train Prisma Access to only pull security group and not distribution group from AD?

Thanks,

[reaper]

are you using Cloud Identity Engine or LDAP?

in LDAP you can select which groups to pull, in CIE you can switch from 'dumb' AD integration (pulls everything) to SCIM which allows you to control (from azure or aws or wherever) which groups to sync

[znazir]

You can primarily enforce group sync restriction on source i.e. LDAP Server, Azure, etc., on Prisma, you cannot do it from Prisma right now 

[hpatel11]

Experience with Panorama Management:
We tried CIE for our early deployment, but it broke several times. No RCA from the support team since we don't have access to backend logs. You are completely blind. I don't suggest you use CIE for security groups.
If you are not an Azure shop and have a reliable connection to OnPrem from Prisma, go with LADAP.