CIE Group Mappings Not Populating in Security Policies for Specific Device Groups

• Group names retrieved via Cloud Identity Engine (CIE) populate in Mobile_User_Device_Group policy dropdowns.

• Group names fail to populate (list appears empty or incomplete) for other device groups in Panorama policies (e.g., Remote_Network_Device_Group or custom on-premises device groups).

• Panorama

• Cloud Identity Engine (CIE)

• Prisma Access

This behavior occurs because Panorama retrieves and populates group names on a per-device-group basis. Even if CIE is globally configured, it must be explicitly associated with each individual device group to enable the metadata sync required for the Panorama UI to display those groups in policy dropdowns.

Prisma Access automatically associates the CIE profile with the default mobile user group during the initial onboarding, but for other device groups, this association must be performed manually.

To resolve this, you must attach the Cloud Identity Engine profile to the affected device group and commit the changes.

1. Verify the CIE Profile Configuration

Ensure you have a functioning CIE profile defined in Panorama:

1. Navigate to Panorama > User Identification > Cloud Identity Engine.

2. Verify that your profile is Enabled and the status shows as connected.

2. Attach CIE to the Affected Device Group

1. Navigate to Panorama > Cloud Services > Configuration.

2. Select the tab corresponding to the affected deployment (e.g., Remote Networks or Mobile Users—Explicit Proxy).

3. Click the gear icon to open the Settings.

4. Go to the Group Mapping Settings (or Cloud Identity Engine) tab.

5. Check the box for Enable Directory Sync Integration.

6. Select your Cloud Identity Engine Profile from the dropdown menu.

7. Click OK.

3. Verify association in Device Groups

1. Navigate to Panorama > Device Groups.

2. Select the specific Device Group that was missing the group names.

3. Ensure the Cloud Identity Engine profile is listed as the source for user/group information.

4. Commit and Push Changes

1. Select Commit > Commit to Panorama.

2. Once the Panorama commit is successful, select Push to Devices and select the relevant Prisma Access or firewall push.

3. After the push, refresh the Panorama web interface and attempt to add a group to a policy rule within that device group. The dropdown should now be populated.