How to Set up Azure SSO multi-role in Prisma Cloud
9901
Created On 03/29/22 16:38 PM - Last Modified 10/26/25 22:41 PM
Objective
Configure Azure SSO on Prisma Cloud with Just in Time Provisioning (JIT) with multi-role.
Environment
- Prisma Cloud
- Microsoft Azure SSO multi-role
Procedure
Prerequisite:
Add at least 1 user to the SSO bypass list: Settings > Access Control List > SSO > Allow select users to authenticate directly with Prisma Cloud. To prevent tenant lock out.
Set up Azure for SSO
- Go to Enterprise application > Prisma Cloud SSO > SAML-based Sign-on
- Click on Add new claims
- Select Groups assigned to the application, Click Save
Claim Group has been added
- Go to Default Directory > All Groups
- Assign groups to Prisma Cloud SSO Enterprise Application and add user/s to it
- Copy Group Object id so we can create role in Prisma Cloud
Note: Groups assignment are not available for Basic Active Directory plan level. It requires at least "ENTERPRISE MOBILITY + SECURITY E5" or "AZURE AD PREMIUM P2" Plan.
Configure SSO on Prisma Cloud
- Create Role using Azure Group Object id Settings > Roles in Prisma Cloud
- Copy Claim Name from Azure and Paste in Settings > SSO > Just in Time (JIT) Provisioning
- Login with SSO and click on Profile bottom. You'll see multiple Roles.
Now you can toggle multiple roles in Prisma Cloud
Additional Information
Set up Azure AD SSO on Prisma Cloud