>
    Strata Copilot
    Prisma Browser for Intune - Supported and Unsupported Capabilities
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. Prisma Browser for Mobile Setup Using Intune
    4. Prisma Browser for Intune - Supported and Unsupported Capabilities
    Download PDF
    Prisma Browser

    Prisma Browser for Intune - Supported and Unsupported Capabilities

    Table of Contents

    Prisma Browser for Intune - Supported and Unsupported Capabilities

    Supported and Unsupported Capabilities

    Overview

    This document details what Prisma Browser for Intune currently supports, what is explicitly not supported (with reasons), and what is planned for upcoming phases.
    Legend
    IconMeaning
    🟢Supported — confirmed working
    🔴Not supported — known limitation
    🟡Partial / In progress

    Conditional Access - Access controls (Entra ID)

    Conditional Access policies in Microsoft Entra ID are critical for organizations controlling access to corporate resources. The following indications are relevant only when they target All resources (formerly 'All cloud apps').
    Conditional Access Grant ControlStatusNotes
    Require multifactor authentication🟢 Supported
    Require authentication strength🟢 SupportedSpecific auth strength policies (e.g., phishing-resistant MFA) are respected.
    Require device to be marked as compliant🟢 SupportedPB for Intune can present the Intune device management certificate to Entra ID, proving the device meets compliance baselines.
    Require app protection policy — configured on cloud app🔴 Not SupportedWhen CA is configured on a cloud app (e.g., M365, Salesforce), PB cannot intercept the CA check. Workaround: Use IdP proxy conditional access to enforce policies at the identity provider level.
    Require password change🟡 N/AThis control applies to user risk policies and is handled by Entra ID directly, not the browser.
    Require risk remediation🔴 Not Supported
    Device platform conditions (iOS/Android)🟢 SupportedCA policies scoped to iOS and/or Android platforms apply correctly.
    When the conditional access policy targets Prisma Browser for Intune, all of the above mentioned policies will not be supported.

    App Protection Policies (Intune)

    Prisma Browser for Intune integrates the Intune SDK. The SDK auto-enforces APP policies configured in the Intune Admin Center through OS-level interception.
    Data Protection
    APP PolicyEnforced?Notes
    Backup org data to iTunes and iCloud backups (iOS only)🟢 Supported
    Backup org data to Android backup services (Android only)🔴 Not SupportedUse profile sync instead
    Send org data to other apps🟢 Supported
    Receive data from other apps🟢 Supported
    Restrict cut, copy, and paste between other apps🟢 Supported
    Screen capture and Google Assistant (Android)🟢 Supported
    Third party keyboards/Approved keyboards🟢 Supported
    Encrypt org data🔴 Not Supported
    Sync policy managed app data with native apps or add-ins🔴 Not Supported
    Printing org data🟢 Supported
    Restrict web content transfer with other apps🔴 Not Supported
    Org data notifications (Android)🟡 Partial
    Allowed / Blocked only.
    ​​Block org data option is not supported.
    Genmoji (iOS)🟢 Supported
    Screen capture (iOS)🟢 Supported
    Writing tools (iOS)🟢 Supported
    Start Microsoft Tunnel connection on app-launch (Android)🟡 N/APrisma Browser has its own tunneling via Prisma Access

    © 2026 Palo Alto Networks, Inc. All rights reserved.