About Thrace

Has anyone effectively used HIP to deny login to Prisma Access? One of the biggest challenges we had with AnyConnect (and a large reason we are moving away) is that there were no native methods for controlling which device a user was connecting with.   I have built a Security Pre-Rule that references the Domain-joined HIP Policy, and I can see the matches in our monitor tab. I would like to deny logon to anyone who does not satisfy this rule EXCEPT those who are members of a specific Active Directory user group.   I figure the rules would look something like this: 1) HIP Match on domain = allowed to connect to Portal URL 2) Match on security group membership = allowed to connect to Portal URL 3) Deny all connections to Portal URL.   Can anyone confirm that this would be effective? ... View more