How to Set up Azure SSO multi-role in Prisma Cloud
13319
Created On 03/29/22 16:38 PM - Last Modified 10/12/26 21:51 PM
Objective
Configure Azure SSO on Prisma Cloud with Just in Time Provisioning (JIT) with multi-role
Environment
- Prisma Cloud
- Microsoft Azure SSO multi-role
Procedure
Prerequisite:
Add at least 1 user to the SSO bypass list: Settings > Access Control List > SSO > Allow select users to authenticate directly with Prisma Cloud. To prevent tenant lock out.
Set up Azure for SSO
- Go to Enterprise application > Prisma Cloud SSO > SAML-based Sign-on
- Click on Add new claims
- Select Groups assigned to the application, Click Save
Claim Group has been added
- Go to Default Directory > All Groups
- Assign groups to Prisma Cloud SSO Enterprise Application and add user/s to it
- Copy Group Object id so we can create role in Prisma Cloud
Note: Groups assignment are not available for Basic Active Directory plan level. It requires at least "ENTERPRISE MOBILITY + SECURITY E5" or "AZURE AD PREMIUM P2" Plan.
Configure SSO on Prisma Cloud
- Create Role using Azure Group Object id Settings > Roles in Prisma Cloud
- Copy Claim Name from Azure and Paste in Settings > SSO > Just in Time (JIT) Provisioning
- Login with SSO and click on Profile bottom. You'll see multiple Roles.
Now you can toggle multiple roles in Prisma Cloud