>
    Strata Copilot
    Managing Enterprise DLP Configuration Changes
    Focus
    Download PDF
    Focus
    1. Home
    2. Enterprise DLP
    3. Managing Enterprise DLP Configuration Changes
    Download PDF
    Enterprise DLP

    Managing Enterprise DLP Configuration Changes

    Table of Contents

    Managing Enterprise DLP Configuration Changes

    Learn more about managing your Enterprise Data Loss Prevention (E-DLP) configuration changes.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Panorama or Strata Cloud Manager)
    • Prisma Access (Managed by Panorama or Strata Cloud Manager)
    • Prisma Browser
    • Enterprise Data Loss Prevention (E-DLP) license
      Review the Supported Platforms for details on the required license for each enforcement point.
    Or any of the following licenses that include the Enterprise DLP license
    • Prisma Access CASB license
    • Next-Generation CASB for Prisma Access and NGFW (CASB-X) license
    • Data Security license
    When managing your Enterprise Data Loss Prevention (E-DLP) configuration across Strata Cloud Manager and a Panorama® management server, a commit on Panorama triggers a Enterprise DLP configuration synchronization to ensure that your Enterprise DLP configuration on Strata Cloud Manager and Panorama match. Ensuring the Enterprise DLP configuration on Strata Cloud Manager and Panorama are synchronized allows you to maintain proper version control and prevents configuration errors that could result in the unintended exfiltration of sensitive data.

    Understanding the Components of a Data Profile

    Understanding the two key components of an Enterprise DLP data profile (Strata Cloud Manager) and a data filtering profile (Panorama) is important.
    • Strata Cloud Manager
      On Strata Cloud Manager, you manage the Enterprise DLP data profile and the DLP rule configurations from discrete places on Strata Cloud Manager.
      • Data Profile—An Enterprise DLP data profile specifies how you want to enforce the sensitive content that you’re filtering. These can include predefined or custom data patterns, as well as any of the advanced detection methods.
      • DLP Rule—The DLP rule defines the type of traffic to inspect, the impacted file types, action, and log severity for the data profile match criteria. Enterprise DLP automatically creates a DLP rule with the same name when you create a new data profile.
    • Panorama
      On Panorama, you manage the Enterprise DLP data profile and the DLP rule configurations from the same data filtering profile. When editing a data filtering profile on Panorama, you can make changes to the data profile, the DLP rule, or both.
      • Data Profile—An Enterprise DLP data profile specifies how you want to enforce the sensitive content that you’re filtering. These can include predefined or custom data patterns. Review the list of advanced detection methods that you can configure on Panorama.
      • DLP Rule—The DLP rule defines the type of traffic to inspect, the impacted file types, action, and log severity for the data profile match criteria. Enterprise DLP automatically creates a DLP rule with the same name when you create a new data profile.
        If the data profile on Strata Cloud Manager includes an advanced detection method marked with Configured on Strata Cloud Manager, you can only configure the DLP rule portion of the data filtering profile.

    When Does a Configuration Sync Occur?

    The point at which an Enterprise DLP configuration sync occurs between Strata Cloud Manager and Panorama depends on where the configuration change was made.
    • Strata Cloud Manager
      No automated Enterprise DLP configuration sync between Strata Cloud Manager and Panorama occurs when making Enterprise DLP configuration changes on Strata Cloud Manager.
      If you manage your Enterprise DLP configuration on Strata Cloud Manager but apply the configuration to your enforcement points managed by Panorama, you must log in to Panorama to initiate a configuration sync. Similarly, if you make Enterprise DLP configuration changes on Panorama, you must take action on Panorama to sync those changes so they reflect on Strata Cloud Manager.
    • Panorama
      Panorama syncs its Enterprise DLP configuration when:
      • You Commit a configuration change on Panorama.
        This can include other unrelated configuration changes or just be an Enterprise DLP configuration change. In this case, Panorama pushes the new Enterprise DLP configuration changes to Strata Cloud Manager.
      • You refresh ObjectsDLPData Filtering Patterns.
        In this case, Panorama pulls the latest data pattern configurations from Strata Cloud Manager.
      • You refresh ObjectsDLPData Filtering Profiles.
        In this case, Panorama pulls the latest data profile configurations from Strata Cloud Manager.
        Keeping the data filtering profiles synchronized between Strata Cloud Manager and Panorama is especially important to prevent configuration errors and commit failures on Panorama. Enterprise DLP assigns all data profiles on Strata Cloud Manager a version on creation and updates the version (+1) when you Save changes to the data profile on Strata Cloud Manager. However, Enterprise DLP does not automatically sync the changes to Panorama. To synchronize, you must manually trigger a sync on Panorama to reflect the data profile changes from Strata Cloud Manager. Otherwise, when the data filtering profile version on Panorama is 10 or more versions behind the data profile on Strata Cloud Manager, commits start to fail with the error profile not found.

    When Should I Commit a Configuration Change?

    When to commit an Enterprise DLP configuration change depends on where you made those changes.
    • Strata Cloud Manager
      Configuration changes on Strata Cloud Manager don't require a commit before you can push those changes to enforcement points. Instead, you make configuration changes and then push those changes to your enforcement points.
    • Panorama
      You must Commit on Panorama when making any kind of configuration change for the following:

    When Should I Push a Configuration Change?

    Strata Cloud Manager requires pushes to enforcement points for configuration changes after you make any of the following changes. For the Admin Scope, you must select All Admins to ensure all changes propagate to impacted enforcement points.
    • Edit data filtering settings
    • Edit snippet settings
    • Create or update a granular data profile
      When you add or update a granular data profile, the data profile may temporarily stop enforcing until the push completes successfully on all enforcement points. During this time, traffic matching the profile's criteria can pass through unchecked.
      To minimize this enforcement gap, push your configuration changes immediately after saving or schedule granular data profile configuration pushes during a maintenance window.
    • Add a Secondary rule to an existing nested data profile that didn't include one when it was first created
    • Modify a DLP rule
      This includes adding it to a Profile Group and adding the Profile Group to a Security policy rule.
      You don't need to push an update for a granular data profile if the only changes made are:
      • Updating or adding an exception rule
      • Adding or removing Users or User Groups in an existing exception rule
    • Modify the Match Scope in a data profile.
    • Add or edit an Endpoint DLP Policy rule
    • Set up evidence storage
    Panorama requires you to push all Enterprise DLP configuration changes to your enforcement points.

    Recommendations

    Review the recommendations for managing when you commit (Panorama only) and push configuration changes to your enforcement points.
    • (Panorama) Ensure your Enterprise DLP configuration change management workflow always includes a Commit to ensure changes are synchronized with Strata Cloud Manager as a standard operating procedure even if you are not ready to push these changes.
    • Ensure your Enterprise DLP configuration change management workflow always includes a configuration push to apply Enterprise DLP configuration changes to your enforcement points. You can push configuration changes during scheduled maintenance or change windows to minimize disruptions.
      (Panorama) Palo Alto Networks does not recommend performing a Commit and Push operation as this can lead to issues with Enterprise DLP.
    • (Strata Cloud Manager) Push Enterprise DLP configuration changes immediately after modifying a granular data profile. Delaying the push can result in a temporary enforcement gap where the granular data profile doesn't enforce correctly and traffic passes through unchecked. Ensure the push scope includes all admins to propagate Enterprise DLP configuration changes to all enforcement points.
    • Develop a step-by-step checklist for managing Enterprise DLP configuration changes to reduce human error. This includes when to commit changes and when to push changes to your enforcement points.
    • (Panorama) Perform a config audit to review and understand the difference between the running and candidate configurations.

    © 2026 Palo Alto Networks, Inc. All rights reserved.