What happens when there are untracked domains in the configuration?

What happens when there are untracked domains in the configuration?

• Prisma Access
• Cloud Identity Engine (CIE) for Group mapping.

1. The untracked domains refer to domains in the form of username or user groups which are Not configured in CIE (Cloud Identity Engine).
2. The CIE on Prisma Access will retrieve the user groups and the users from connected directory based on the Prisma Access configuration (For example Security rules with users or groups in them)
3. The expectation is that the the domains configured in rules configuration should be same as the one defined in CIE integration.
4. If the configuration has the presence of untracked domains, this can result in unexpected user id behaviour and errors on the CIE side.
5. For example, The CIE is integrated with a Cloud directory and the domain defined is example.com
6. The security rules contains usernames with example.com and in addition, also contains domains company.com which is not tracked by CIE.
7. The errors/unexpected behavior can be fixed by removing the untracked domains from the configuration followed by a push.