1. Overview

Many organizations use SAML to authenticate users for web services. Prisma Cloud supports the SAML 2.0 federation protocol to access Prisma Cloud Console. When SAML support is enabled, users can log into Console with their federated credentials. This article provides detailed steps for federating your Prisma Cloud Console with your Azure Active Directory (AAD) tenant’s Identity Provider (IdP).

The Prisma Cloud/Azure Active Directory SAML federation flow works as follows:

  1. Users browse to Prisma Cloud Console.

  2. Their browsers are redirected to the AAD SAML 2.0 endpoint.

  3. They enter their AAD credentials to authenticate. Multi-factor authentication can be enforced at this step.

  4. An AAD SAML token is returned to Prisma Cloud Console.

  5. Prisma Cloud Console validates the Azure Active Directory SAML token’s signature and associates the user to their Prisma Cloud account via user identity mapping or group membership. Prisma Cloud supports SAML groups for Azure Active Directory federation.

The Azure Portal may change the Enterprise Application SAML federation workflow over time. The concepts and steps outlined in this document can be applied to any Non-gallery application.

The Prisma Cloud Console is integrated with Azure Active Directory as a federated SAML Enterprise Application. The steps to set up the integration are:

2. Configure Azure Active Directory

Configure Azure Active Directory.

Prerequisites:

  • Required Azure Active Directory SKU: Premium

  • Required Azure Active Directory role: Global Administrator

  1. Log onto your Azure Active Directory tenant (https://portal.azure.com).

  2. Go to Azure Active Directory > Enterprise Applications

  3. On the top left of the window pane, click + New Application.

  4. Select Non-gallery application, from the Add your own app section.

    aad saml 20180912 1
  5. In the Name field, enter jdong-console, then click Add. In this example I am using "jdong-console"

  6. On the jdong-console menu select Single sign-on and choose SAML

    aad saml 20200305 1
  7. Section #1 Basic SAML Configuration:

    1. Identifier: jdong-console (Set to your Console’s unique Audience value. You will configure this value within your Console at a later step.)

    2. Reply URL: https://<FQDN_of_your_Prisma Cloud_Console>:8083/api/v1/authenticate.

      aad saml 20200305 2
  8. Section #2 User Attributes & Claims:

    Select the Azure AD user attribute that will be used as the user account name within Prisma Cloud. This will be the NameID claim within the SAML response token. We recommend using the default value.

    1. Unique User Identifier (Name ID): user.userprincipalname [nameid-format:emailAddress]

      aad saml 20200305 3
      Even if you are using AAD Groups to assign access to Prisma Cloud set this value.
  9. Section #3 SAML Signing Certificate:

    1. Select Download: Certificate (Base64)

    2. Select the Pen icon.

    3. Set Signing Option: Sign SAML Response and Asertion

      aad saml 20200305 4
  10. Section #4 Set up jdong_console:

    Save the value of of Login URL and Azure AD Identifier. We will use these later for configuration in the Prisma Cloud Console.

    aad saml 20200305 5
  11. Copy the Application ID. You can find this going to Properties tab in the Manage section of the application.

  12. Click on Users and Groups within the Manage section of the application. Add the users and/or groups that will have the right to authenticate to Prisma Cloud Console.