When an application operating within the scope of a defined policy downloads or modifies a file, that file is automatically isolated within a secure containment boundary (referred to as a "bubble"). Once protected, access to the file is strictly restricted: only authorized applications running within the same isolated environment can open, view, or edit it. Any external applications or processes outside this bubble are prohibited from accessing, reading, or modifying the protected file, thereby preventing unauthorized data exposure and protecting sensitive information from external threats.

In the Control tab, select the following options, as required.

1. Select one of the following options:
   • Apply bubble protection to files - Files are protected and can be used only within the protected applications bubble.
   • Custom settings for file upload & download - Manually set the security behavior for each direction.
2. To configure File Downloads:
   • Allow - Prisma Browser will allow all downloads.
   • Use files in Prisma Browser only - – Prisma Browser will only open downloads in the browser.
   • Save to Organization Storage - Users won't be able to download the files directly. Files will be uploaded to the cloud storage that you selected.
     • Organizational storage - Select the cloud storage provider from the list.
   • Block - Prisma Browser will block all downloads.
   The File Download directive also controls whether the Download section is visible in the Native RDP session toolbar. When File Download is set to Block, the download option is automatically hidden from the RDP toolbar. For more information, see File Transfer in Native RDP Sessions.
3. To configure File Uploads:
   • Allow - Prisma Browser will allow all uploads. -
   • Block - the Prisma Browser will block all uploads. -
   • Block only protected files -
   The File Upload directive also controls whether the Upload to Desktop section is visible in the Native RDP session toolbar. When File Upload is set to Block, the upload option is automatically hidden from the RDP toolbar. For more information, see File Transfer in Native RDP Sessions.
4. Select the Apply on tab to continue.
5. Apply the restrictions on the following file types:
6. • Any file - the download restrictions will apply to all files.
   • Specific files- the download restrictions will apply to files that meet the selected specifications (the rule can contain as many of these specifications as needed):

     • Specific files for download - Apply the restrictions only to files that meet the following criteria:
       • File size - Set the size of the file. You can configure the rule to download files larger or smaller than your selected value.
       • File types - Set the file types that need to match this rule. You can configure the rule to match a particular file type or a particular extension.
       • File hash - Set the SHA-256 hash to be matched for this rule. You can configure the rule to match or not match the hash.
     • Specific files for upload - Apply the restrictions only to files that meet the following criteria:
       • File size - Set the size of the file. You can configure the rule to upload files larger or smaller than your selected value.
       • File types - Set the file types that need to match this rule. You can configure the rule to match a particular file type or a particular extension.
       • File hash - Set the SHA-256 hash to be matched for this rule. You can configure the rule to match or not match the hash.
7. Select the Prompt tab to continue.
8. Display the following Prompts before downloading or uploading the file:
   • None - Do not display any prompts.
   • Custom prompt per action -
     • Before Download -
       • Warn and allow to proceed anyway - informs users about the risk or sensitivity of downloading files but allowing them to continue.
       • Warn and allow to proceed anyway with a reason - informs users about the risk or sensitivity of downloading files and require them to select a reason to continue.
       • Permission request - allows users to send a permission request to the admin. The user will be informed once the request is approved or denied.
     • Before Upload -
       • Warn and allow to proceed anyway - informs users about the risk or sensitivity of uploading files but allowing them to continue.
       • Warn and allow to proceed anyway with a reason - informs users about the risk or sensitivity of uploading files and require them to select a reason to continue.
       • Permission request - allows users to send a permission request to the admin. The user will be informed once the request is approved or denied.
9. Select the MFA tab to continue.
10. Require Multi-Factor Authentication (MPA) before performing the action.
    • Not Set - Do not use MFA.
    • Require MFA:
      • Before Download.
      • Before Upload.
        • Require users to complete an additional authentication (PIN code, passkey, or IdP authentication) before downloading files. Configure the authentication factor used under Authentication Factor
11. Select the Dialog Text tab to continue.
12. This tab allows you to customize the message that your users will see when they are blocked.
13. Click Set.