GSA coexistence with Palo Alto Networks
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 88362de · +9 −9 lines · also on GitHub
⋯ 4 unchanged lines
55
ms.author: kenwith
66
manager: dougeby
77
ms.topic: how-to
8
−ms.date: 05/23/2025
8
+ms.date: 10/07/2025
99
ms.service: global-secure-access
1010
ms.subservice: entra-private-access
1111
ms.reviewer: shkhalid
⋯ 9 unchanged lines
2121
2222
This document contains steps to deploy these solutions side by side across several different access scenarios.
2323
24
−1. [**Configuration 1: Microsoft Entra Private Access with Palo Alto Prisma Access for secure Internet Access**](#configuration-1-microsoft-entra-private-access-with-palo-alto-prisma-access-for-secure-internet-access)
24
+1. [**Microsoft Entra Private Access with Palo Alto Prisma Access for secure Internet Access**](#microsoft-entra-private-access-with-palo-alto-prisma-access-for-secure-internet-access)
2525
2626
In this scenario Global Secure Access will handle private application traffic. Prisma Access will only capture Internet traffic.
2727
28
−2. [**Configuration 2: Microsoft Entra Private Access with Palo Alto Prisma Access for Private Application and Internet Access**](#configuration-2-microsoft-entra-private-access-with-palo-alto-prisma-access-for-private-application-and-internet-access)
28
+2. [**Microsoft Entra Private Access with Palo Alto Prisma Access for Private Application and Internet Access**](#microsoft-entra-private-access-with-palo-alto-prisma-access-for-private-application-and-internet-access)
2929
3030
In this scenario both clients will handle traffic for separate private applications. Private applications in Microsoft Entra Private Access will be handled by Global Secure Access while private applications in Prisma Access service connections, or ZTNA connectors, will be accessed through GlobalProtect client. Internet traffic will be handled by Prisma Access.
3131
32
−3. [**Configuration 3: Microsoft Entra Microsoft Access with Palo Alto Prisma Access for Private Application and Internet Access**](#configuration-3-microsoft-entra-microsoft-access-with-palo-alto-prisma-access-for-private-application-and-internet-access)
32
+3. [**Microsoft Entra Microsoft Access with Palo Alto Prisma Access for Private Application and Internet Access**](#microsoft-entra-microsoft-access-with-palo-alto-prisma-access-for-private-application-and-internet-access)
3333
3434
In this scenario Global Secure Access will handle all Microsoft 365 traffic. Prisma Access will handle Private applications via service connection or ZTNA connectors. Internet traffic will be handled by Prisma Access.
3535
36
−4. [**Configuration 4: Microsoft Entra Internet Access and Microsoft Entra Microsoft Access with Palo Alto Prisma Access for Private Application Access**](#configuration-4-microsoft-entra-internet-access-and-microsoft-entra-microsoft-access-with-palo-alto-prisma-access-for-private-application-access)
36
+4. [**Microsoft Entra Internet Access and Microsoft Entra Microsoft Access with Palo Alto Prisma Access for Private Application Access**](#microsoft-entra-internet-access-and-microsoft-entra-microsoft-access-with-palo-alto-prisma-access-for-private-application-access)
3737
3838
In this scenario Global Secure Access will handle Internet and Microsoft 365 traffic. Prisma Access will only capture private application traffic via service connection or ZTNA connectors.
3939
⋯ 49 unchanged lines
8989
> [!NOTE]
9090
> In Configuration 4, if you face issues connecting with GlobalProtect using local users, try setting up Microsoft Entra SSO.
9191
92
−## Configuration 1: Microsoft Entra Private Access with Palo Alto Prisma Access for secure Internet Access
92
+## Microsoft Entra Private Access with Palo Alto Prisma Access for secure Internet Access
9393
9494
In this scenario Global Secure Access will handle private application traffic. Prisma Access will only capture Internet traffic.
9595
⋯ 40 unchanged lines
136136
12. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. In the **Traffic** dialog box, select **Stop collecting**.
137137
13. Scroll to confirm the Global Secure Access client handled only private application traffic.
138138
139
−## Configuration 2: Microsoft Entra Private Access with Palo Alto Prisma Access for Private Application and Internet Access
139
+## Microsoft Entra Private Access with Palo Alto Prisma Access for Private Application and Internet Access
140140
141141
In this scenario both clients will handle traffic for separate private applications. Private applications in Microsoft Entra Private Access will be handled by Global Secure Access while private applications in Prisma Access service connections, or ZTNA connectors, will be accessed through GlobalProtect client. Internet traffic will be handled by Prisma Access.
142142
⋯ 41 unchanged lines
184184
13. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. In the network traffic dialog box, select **Stop collecting**.
185185
14. Scroll to confirm the Global Secure Access client handled private application traffic for the SMB file share and didn't handle the RDP session traffic.
186186
187
−## Configuration 3: Microsoft Entra Microsoft Access with Palo Alto Prisma Access for Private Application and Internet Access
187
+## Microsoft Entra Microsoft Access with Palo Alto Prisma Access for Private Application and Internet Access
188188
189189
In this scenario Global Secure Access will handle all Microsoft 365 traffic. Prisma Access will handle Private applications via service connection or ZTNA connectors and Internet traffic.
190190
⋯ 44 unchanged lines
235235
15. You can also validate that the traffic is captured in the Global Secure Access traffic logs. In the Microsoft Entra admin center, navigate to **Global Secure Access** \> **Monitor** \> **Traffic logs**.
236236
16. Validate traffic related to Outlook Online and SharePoint Online is missing from Prisma Access logs in Strata Cloud Manager **Incidents & Alerts** \> **Log Viewer**.
237237
238
−## Configuration 4: Microsoft Entra Internet Access and Microsoft Entra Microsoft Access with Palo Alto Prisma Access for Private Application Access
238
+## Microsoft Entra Internet Access and Microsoft Entra Microsoft Access with Palo Alto Prisma Access for Private Application Access
239239
240240
In this scenario Global Secure Access will handle Internet and Microsoft traffic. Prisma Access will only capture private application traffic via service connection or ZTNA connectors.
241241
⋯ 49 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:50 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.