USER-ID policies + FULL azure ad

[LCutman]

Hello everyone ,

I'm having a problem that I can't solve.

I'll explain the context.
I am in full AZURE AD.
My computers are enrolled via INTUNE

I would like to be able to set up user-based firewall rules.
I set up the "cloud identity engine" (linked to azure ad), I can see my groups and my users in the palo alto.
When I create a firewall rule and I associate a user to it, the rule has no effect on this user.
Do you have an idea ?

Thanks in advance

[OtakarKlier]

Hello,

I would check the policy you created against a traffic log to see if you accidentally missed something. Also check how the users names are displayed in the logs vs how they are in the policy.

Regards,

[LCutman]

HI @OtakarKlier

Thank you for taking the time to look at my question?

Here is some screenshot of my configuration

[OtakarKlier]

Hello,

Honestly I never had to deal with Azure AD, bt something is off. I would open a case with PAN support on this one. Also just a few suggestions:

1. I would recommend having a zone protection profile for you inside zones as well as external zones.
2. Hopefully you are using a secure DNS. I understand that the google DNS was just ICMP only.

Regards,

[mikealanni · Accepted solution]

I have some questions, but I think you are missing the User-IP mapping as the cloud identity engine won't provide IP. So far I heard only GP always one can help

[LCutman]

Good morning
I simply did a test with a ping to 8.8.8.8

But the configuration is not finalized yet