>
    Strata Copilot
    Prisma Browser Login Configuration Guide
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. Prisma Browser for Mobile Setup Using Intune
    4. Prisma Browser Login Configuration Guide
    Download PDF
    Prisma Browser

    Prisma Browser Login Configuration Guide

    Table of Contents

    Prisma Browser Login Configuration Guide

    Login configuration guide
    This guide provides technical specifications and administration steps for configuring user login behavior in Prisma Browser (and Prisma Browser for Intune) across iOS and Android endpoints using Microsoft Intune MDM App Configuration policies and Single Sign-On (SSO) profiles.
    Building upon device compliance baseline policies, you can combine Username Pre-fill (EMAIL), Auto-Login (AUTO_LOGIN), Onboarding Controls (SKIP_PRELOGIN_ONBOARDING), and System SSO Extensions (Okta / Microsoft Entra ID) to deliver a frictionless, passwordless user authentication experience.

    Intune App Configuration Setup Workflow

    To deploy login settings across managed iOS and Android devices:
    1. Open the Microsoft Intune Admin Center.
    2. Navigate to Apps > App configuration policies > Add > Managed devices.
    3. In the Basics tab, provide a descriptive name (for example: Prisma Browser - Login and SSO Configuration), select platform (iOS/iPadOS or Android), and choose Prisma Browser (or Prisma Browser for Intune).
    4. In the Settings tab, set Configuration settings format to Use configuration designer.
    5. Add the required MDM configuration keys (detailed below) with their designated value types and values.
    6. Assign the policy to target user or device groups and click Create.
    Policy sync generally takes 15–30 minutes, and you may need to restart the browser.

    Email Pre-fill Configuration

    The EMAIL key allows administrators to populate the user's primary corporate email address on the browser login screen automatically.
    • Configuration Key: EMAIL
    • Value Type: String
    • Configuration Value: {{userprincipalname}}
    • Supported Platforms: iOS, Android (version 26.06.00+)
    • App Support: Standard Prisma Browser and Prisma Browser for Intune
    Behavior & Caveats
    • iOS: The pre-filled email address remains editable by the end user on the initial launch unless AUTO_LOGIN is enabled. On subsequent sign-ins (once the application retains user identity), the field is locked.
    • Android: The pre-filled address is immediately locked whenever a value is provided, regardless of whether AUTO_LOGIN is set.
    • Best Practice: Always use the dynamic MDM variable {{userprincipalname}} so that Intune assigns the correct individual address to each managed endpoint.

    Onboarding & Auto-Login Controls

    Skip Pre-login Onboarding
    Controls whether the first-launch informational onboarding screens appear before the user logs in.
    • Configuration Key: SKIP_PRELOGIN_ONBOARDING
    • Value Type: Boolean
    • Configuration Value: true (to bypass) or false (to display)
    • Supported Platforms: iOS, Android
    • App Support: Both standard Prisma Browser and Prisma Browser for Intune
    • Behavior: Setting this key to false forces the app to show onboarding screens even when AUTO_LOGIN is enabled, overriding the default auto-suppression behavior.
    Automatic Form Submission
    Submits the login form automatically when combined with the pre-filled email address.
    • Configuration Key: AUTO_LOGIN
    • Value Type: Boolean (also accepts String "true" or "1")
    • Configuration Value: true
    • Supported Platforms: iOS, Android (version 26.06.00 or later)
    • App Support: Both standard Prisma Browser and Prisma Browser for Intune
    • Behavior:
      • On iOS, enabling AUTO_LOGIN automatically bypasses the first-launch onboarding screens (unless SKIP_PRELOGIN_ONBOARDING is explicitly set to false). Auto-submit is temporarily suppressed after a manual sign-out to allow account switching, resetting upon the next successful sign-in.
      • On Android, auto-submit remains active and is not suppressed following manual sign-out.

    Single Sign-On (SSO) Extension Configuration

    To eliminate manual credential prompts and MFA redirections, Prisma Browser integrates with Apple's Extensible Single Sign-On (SSO) framework and native OS identity plugins (such as Okta FastPass and Microsoft Enterprise SSO Plug-in).
    Microsoft Enterprise SSO Plug-in (Entra ID)
    Deploy an Intune Device Configuration Profile to route authentication silently via Microsoft Authenticator:
    1. In Intune, go to Devices > Configuration profiles > Create profile.
    2. Platform: iOS/iPadOS, Profile type: Templates, Template name: Device Features.
    3. Under Single sign-on app extension, select extension type Microsoft Entra ID.
    4. In Additional configuration, enter the following key-value pairs:
      • AppPrefixAllowList (String): com.apple., com.microsoft., com.talon-sec.work.ios
      • browser_sso_interaction_enabled (Integer): 1
      • disable_explicit_app_prompt (Integer): 1
      • Enable_SSO_On_All_ManagedApps (Integer): 1
    5. Assign to target device groups and deploy.
    Okta FastPass SSO Extension
    For environments using Okta Identity Engine (OIE):
    • Deploy Okta Verify via Intune.
    • Deploy an iOS Single Sign-On Extension payload targeting extension com.okta.mobile.auth-service-extension and declaring corporate authentication domains.
    • Prisma Browser securely delegates background authentication to Okta Verify without prompting for credentials.

    © 2026 Palo Alto Networks, Inc. All rights reserved.