This guide provides instructions to integrate Prisma Access with Beyond Identity to deliver secure and frictionless authentication for your extended workforce, contractors, consultants, agents, and suppliers.

Prisma Access integrates with Beyond Identity Secure Workforce using SAML 2.0 protocol. Prisma Access acts as the SAML Service Provider and Beyond Identity acts as the SAML Identity Provider. Global Protect Cloud Services mobile agent uses this integration to login passwordlessly to Prisma Access.

Contents

• How this integration works 
  
• Prerequisites
• Configure Beyond Identity 
• Configure Prisma Access

How this integration works

Prerequisites

• Prisma Access tenant
• Beyond Identity Secure Workforce tenant (with users configured and enrolled)

Configure Beyond Identity 

To configure Beyond Identity as the SAML Identity Provider:

1. Login to Beyond Identity Admin console.
2. Go to Integrations > SAML.
3. Click Add SAML Connection.
   
4. Enter the following values
   • Name: Beyond Identity IdP-Global Protect
   • SP Single Sign-on URL: https://<prisma_access_tenant_name>.gpcloudservice.com:443/SAML20/SP/ACS
   • SP Audience URI: https://<prisma_access_tenant_name>.gpcloudservice.com:443/SAML20/SP
   • Name ID format: unspecified
   • Subject User Attribute: UserName
   • Request Binding: http redirect
   • Authentication Context Class: X509
   • Signed Response: Signed
5. Click Save Changes.
6. On the right side of the newly created entry, click the Download Metadata icon to download the metadata file.

Configure Prisma Access

To configure Prisma Access as the SAML Service Provider:

1. Log into the Prisma Access Admin UI.
2. Go to Manage > Configuration > Identity Services > Authentication.
3. Select Mobile Users > GlobalProtect using the drop-down next to Authentication.
4. Go to Authentication Profiles.
5. Click Add Profile.
   
   
6. Enter "Beyond Identity IdP - GlobalProtect" as the Profile Name.
7. Click Import MetaData.
8. Click Choose File and select the metadata file downloaded from the Beyond Identity Admin console.
9. Click Import.
10. Click Save.