If the web browser that the user used to authenticate the Prisma Access Agent remains open, traffic from the web browser to Prisma Access Agent will be sent over the tunnel regardless of how the forwarding profile is configured.

On macOS devices that have the Prisma Access Agent installed, if you remove the full disk access for the security extension for the Prisma Access Agent (after granting full disk access previously), the Prisma Access Agent will get stuck in the disabled mode.

Workaround: Grant access to the security extension by selecting System SettingsPrivacy & Security Full Disk Access and enabling the securityExtension from the list of apps.

When configuring forwarding profiles, an issue exists where configuring large numbers of forwarding rules for source applications, destination domains, and IP addresses (routes) can cause high CPU utilization.

Workaround: Do not configure more than 100 forwarding rules for source applications, destination domains, and IP addresses.

In Insights, the Project Connectivity History doesn't show the correct data when the Time Range is set to Past 3 Hours, Past 1 Hour, and Past 15 Minutes.

In Insights, the number of connected users listed in the Projects tab might not be accurate. In some cases, the number of connected users in the Project tab does not match the number of users in the Users tab. For example, when the same user is connected to two projects on different devices, the number of connected users in the Projects tab does not match the number of users in the Users tab.

In Insights, the Projects tab does not show all the IP pools that are configured for a project. Only the IP pools that are in use are shown.

User groups that have more than 50000 users are not supported in the project configuration of Dynamic Privilege Access. Make sure that the user group associated with a project has less than 50000 users.

When configuring forwarding profiles, even though Strata Cloud Manager allows you to configure IP addresses with wildcards, using wildcard characters in destination IP addresses, such as 10.*.*.*, is not supported as it will cause inconsistent behavior in forwarding profiles.

Changing a project name in the Projects tab of the Dynamic Privilege Access page in Strata Cloud Manager is not supported at this time.

Workaround: To rename a project, delete the existing project and perform an Access Agent push configuration, then create the project with the new name and perform an Access Agent push configuration.

On a Prisma Access tenant where Dynamic Privilege Access is enabled, a configuration push will fail if you try to push the Prisma Access Agent infrastructure configuration without first configuring any projects.

Workaround: Configure at least one project before you do a push config.

An issue exists where the duration for synchronizing directory changes in the Cloud Identity Engine varies based on the directory and the volume of changes. If the directory changes are minimal, the Cloud Identity Engine usually completes the sync in minutes. However, if there are numerous changes in the directory, the directory sync might take hours to complete.

Updates made in the Identity Provider (IdP) are not immediately reflected in the Cloud Identity Engine and Prisma Access Agent management plane. This delay occurs because the Cloud Identity Engine needs to sync with the IdP to capture the changes. The Cloud Identity Engine runs sync jobs every 5 minutes, but only when no other sync is in progress. The duration of the sync process is affected by the magnitude of changes in the Cloud Identity Engine directory, meaning larger or more numerous changes will result in a longer sync time. After the sync is complete, it can take up to 15 minutes for the changes to appear in the Prisma Access Agent management plane.

When searching for a user group in Cloud Identity Engine or Strata Cloud Manager using the Text Search option, surround the user group name with double quotes. For example, when searching for a user group named EXAMPLE.User_Group, enter "EXAMPLE.User_Group".

When configuring a project in Strata Cloud Manager, you cannot search for a User group by providing a partial user group name.

Workaround: To search for a user group, enter the complete User group name.

An issue exists in Dynamic Privilege Access where existing IP pools configured in a project cannot be modified.

Workaround: To modify an existing IP pool, delete the existing IP pool in a project and save the project. Then, edit the project again to add the new IP pool. For example, to change the IP pool address from 10.10.10.0/25 to 10.10.10.0/24, delete the existing pool in the project, save the project, and edit the project again to add the new IP pool.

Enabling ZTNA Connector on a Dynamic Privilege Access enabled tenant is not supported in Prisma Access 5.2.

Enabling ZTNA Connector on a Dynamic Privilege Access enabled tenant can cause issues in routing. Service might also be impacted because Strata Cloud Manager does not support the deletion of ZTNA Connector once it has been created.

When authorizing user group mapping in Cloud Identity Engine for Dynamic Privilege Access, when selecting the SAML attributes you want Prisma Access to use for authentication, ensure that you select a Username Attribute that contains /identity/claims/name.

If you select the wrong username attribute, your users will not be able to authenticate to their projects.

An issue exists where random tunnel disconnects can occur if the Collect HIP Data option is not enabled in the Agent Settings page. Therefore, do not disable Collect HIP Data in the Host Information Profile (HIP) section of the Access Agent Settings page.

For Cloud Identity Engine authentication to work on a Dynamic Privilege Access enabled Prisma Access tenant, ensure that a user group is not mapped to multiple SAML applications in the identity provider (IdP).

If multiple apps are mapped to a user group, Cloud Identity Engine cannot determine which SAML app to connect to during authentication because there is no unique mapping.

On a Prisma Access tenant where Dynamic Privilege Access is enabled, a Mobile User ContainerAccess Agent configuration push will fail without first configuring a project in Strata Cloud Manager.

Workaround: Configure at least one project before you do a push config.

The number of IP pools that are supported per project is 50. The performance will be impacted if the number of IP pools per project exceeds 50.

Workaround: Allocate no more than 50 IP pools per project.

On a Dynamic Privilege Access enabled tenant, Strata Cloud Manager allows you to configure more than 100 IP pools per project, even though it will cause the push config to fail with a generic error.

Workaround: Do not configure more than 100 IP pools per project.

An issue exists where, when setting up a forwarding profile, the forwarding profile Type is displayed as "ZTNA Agent" instead of "Prisma Access Agent". Also, if you select Add Forwarding Profile, the drop-down shows "ZTNA Agent" instead of "Prisma Access Agent".

Workaround: None. The forwarding profile type will be changed to "Prisma Access Agent" in the future.

Do not create snippets with descriptions that contain special characters. Snippet descriptions that contain special characters such as ! ~ @ # $ % ^ & * ( ) _ + are not supported.

When setting up a forwarding profile, an issue exists where all the options in the Traffic Enforcement section of the Forwarding Profile page are enabled by default. Enabling all of these options by default can cause unexpected or undesirable behavior.

Workaround: Disable these options for Dynamic Privilege Access.

When setting up a forwarding profile, an issue exists where the Enforce FQDN DNS resolution using tunnel DNS servers and Resolve all FQDNs using DNS servers that are assigned by the tunnel (Windows agents only) options are shown in the Traffic Enforcement section of the Forwarding Profile page.

These two options should not be shown since the intended functionality of these options can be configured using the forwarding profile rules.

Strata Cloud Manager uses the user and user group information from a Cloud Identity Engine directory in multiple configurations, such as Dynamic Privilege Access project configurations, Prisma Access Agent settings, security policies, and staged rollout configurations. After making these configurations, if you delete the directory from Cloud Identity Engine but don't delete the Strata Cloud Manager configurations that reference those users and user groups, you might encounter unexpected errors, such as "500 Internal Server Error."

Workaround: When you remove a directory from Cloud Identity Engine, you must also delete the Strata Cloud Manager configurations that reference the users and user groups in that directory.

An issue exists in the Access AgentInfrastructure Settings page in Strata Cloud Manager, where both the Prisma Access Managed and OnPrem DHCP Server options appear in the Client IP Pool Allocation section.

When provisioning users on a General Availability Prisma Access tenant with Dynamic Privilege Access enabled, ensure that you do not select OnPrem DHCP Server because the configuration cannot be reverted once you save it. OnPrem DHCP Server is not supported for Dynamic Privilege Access General Availability tenants and will be removed from Strata Cloud Manager in a future release. If you select OnPrem DHCP Server, your tenant will be rendered unusable for basic Dynamic Privilege Access workflows.

Do not use special characters in project names, otherwise Strata Cloud Manager will issue a "Malformed Request" error message when you try to save the project configuration.

In the Agent Settings page in Strata Cloud Manager, the recommended value for the Session timeout is 7 days.

When creating a snippet, if you disable the Add prefix to object names option, ensure that you don't use duplicate agent settings names in two different snippets, since it can result in unexpected behavior.

In Access AgentInfrastructure Settings in Strata Cloud Manager, the OnPrem DHCP Server option in the Client IP Pool Allocation section is not selectable. This is working as intended since OnPrem DHCP Server is not supported for Dynamic Privilege Access.

This option will be renamed to OnPrem DHCP Server (Preview Only) so that existing Dynamic Privilege Access enabled Prisma Access tenants can function correctly.

An issue exists where you are allowed to create more than one project with the same domain and user group if those projects were configured from different configuration snippets. Avoid this configuration because it can cause unexpected behavior in some Strata Cloud Manager workflows.

Workaround: Do not configure different projects using the same domain and user group.