>
    Strata Copilot
    Allocate ION Devices for an Existing TSG-Enabled Tenant
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma SD-WAN
    3. Prisma SD-WAN Administrator’s Guide
    4. Get Started with Prisma SD-WAN
    5. Activate and Launch Prisma SD-WAN
    6. Allocate ION Devices for an Existing TSG-Enabled Tenant
    Download PDF
    Prisma SD-WAN

    Allocate ION Devices for an Existing TSG-Enabled Tenant

    Table of Contents

    Allocate ION Devices for an Existing TSG-Enabled Tenant

    Allocate ION devices and subscriptions to an existing Prisma SD-WAN tenant that has been migrated to a Tenant Service Group (TSG).
    Where Can I Use This?What Do I Need?
    • Prisma SD-WAN (Managed by Strata Cloud Manager)
    • Prisma SD-WAN
    • Superuser or IAM Administrator role
    • TSG-enabled tenant
    If you are an existing Prisma® SD-WAN customer with a TSG-enabled tenant, use the following steps to allocate ION devices and subscriptions from a recent purchase to your tenant. ION devices and subscriptions purchased separately do not appear in your tenant automatically — this allocation process links them to your tenant so you can begin managing and configuring them.
    After Palo Alto Networks fulfills your order, the admin associated with the purchase receives an activation email that includes a magic link — a one-time URL that launches the guided allocation flow.
    Depending on how your purchase order was processed, you may receive more than one magic link. Repeat these steps for each link you receive. Do not use the same magic link twice, as each link activates a specific set of devices or subscriptions.
    If you do not know your TSG ID, see Find Your Tenant Service Group (TSG) ID before you begin Step 4.
    1. Locate the activation email from Palo Alto Networks and click Activate.
      If you did not receive the activation email, check your spam folder. If the email is not there, contact Palo Alto Networks Support to resend it.
    2. Enter the email address associated with your Customer Support Portal account and click Sign In.
    3. On the Activate Subscription page, choose a Customer Support Account for Prisma SD-WAN.
      For organizations with multi-tenant hierarchies, Palo Alto Networks recommends using the same Customer Support Portal account for all Prisma SD-WAN assets to avoid visibility and management inconsistencies across tenants.
    4. Choose the TSG ID to which you want to allocate your devices and subscriptions.
      A list of TSG IDs associated with your Customer Support Portal account appears on this page.
      For organizations with a multi-tenant hierarchy, Palo Alto Networks recommends allocating devices and subscriptions to the root tenant, then using the Prisma SD-WAN device manager to assign devices to sub-tenants. Allocating directly to a sub-tenant can cause visibility and management issues at the root level, including incomplete device counts and incomplete policy inheritance.
    5. Agree to the Terms and Conditions.
    6. Click Activate Now.
      • Region selection applies only to new tenant activations.
      • For existing tenants, the region defaults to the region where you originally activated the tenant.
      After activation, all allocated device serial numbers appear in your tenant. It may take 15–60 minutes for all devices to appear in the web interface. If devices do not appear after 60 minutes, contact Palo Alto Networks Support.
    7. Select ConfigurationPrisma SD-WANION Devices and click the Unclaimed Devices tab.
      The Unclaimed Devices tab lists all devices allocated to your tenant.
      It may take 15–60 minutes for all devices to appear in the web interface. If devices do not appear after 60 minutes, contact Palo Alto Networks Support.

    Find Your Tenant Service Group (TSG) ID

    A Tenant Service Group (TSG) is a logical container that groups tenants and other TSGs within the Prisma SASE platform. At the leaf level of a tenant hierarchy, a tenant and a TSG share the same technical structure, so the terms are sometimes used interchangeably in the platform interface.
    After your Prisma SD-WAN instance is migrated to a Tenant Service Group, you have access to Common Services for subscription management, tenant management, and identity and access management. Use the following steps to locate your TSG ID. You will need it in Step 4 of the device allocation process.
    1. Log in to the hub.
    2. Select Common ServicesTenant Management.
      If you are using the View by Support Account view and cannot locate your Prisma SD-WAN application, your tenant is TSG-migrated. Select Common ServicesTenant Management to locate your TSG ID.
    3. Select a tenant and note the TSG ID displayed in the upper-right corner of the page.
      Copy or note this TSG ID. You need it in Step 4 of the device allocation process to select the correct allocation target.

    © 2026 Palo Alto Networks, Inc. All rights reserved.