>
    Strata Copilot
    Prisma Browser for Intune - Complete Deployment Guide
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. Prisma Browser for Mobile Setup Using Intune
    4. Prisma Browser for Intune - Complete Deployment Guide
    Download PDF
    Prisma Browser

    Prisma Browser for Intune - Complete Deployment Guide

    Table of Contents

    Prisma Browser for Intune - Complete Deployment Guide

    .Prisma Browser for Intune Deployment Guide
    Where Can I Use This?What Do I Need?
    • Microsoft Intune Administrator
    • Entra ID Directory Role:
      • Global Administrator
      • Privileged Administrator
      • Cloud Application Administrator
    • iOS Deployment
      • iOS/iPadOS devices (iOS 18.0 or newer)
      • Access to Apple App Store (for user installation) OR Apple Business Manager (for VPP deployment)
      • Devices enrolled in Intune (for MDM features; not required for MAM)
    • Android Deployment
      • Android devices (Android 12.0 or newer)
      • Access to Google Play Store (for user installation) OR Managed Google Play (for enterprise deployment)
      • Devices enrolled in Intune (for MDM features; not required for MAM)
    • License Requirements for all deployments
      • Users must be assigned an Intune license
      • Entra ID Premium (for Conditional Access features)
    Prisma Browser for Intune offers seamless integration with Microsoft’s Mobile Device Management (MDM) and Mobile Application Management (MAM) frameworks. This allows IT teams to manage browser security policies and monitor user activity directly within the Microsoft Intune console, removing the need to navigate between multiple platforms.
    Key Integration Benefits
    • Unified Policy Management: Manage all mobile security settings centrally through Entra ID and Intune, eliminating the need for separate policy configurations in the Prisma console.
    • Enhanced Security: Directly embed Intune security controls into the browser to safeguard corporate data across both iOS and Android devices.
    • Simplified Access Control: Facilitate the deployment of conditional access and establish Prisma as the required browser for managed applications.
    • Streamlined Administration: Gain comprehensive visibility into mobile web activity while preserving a standard user experience.
    Deployment Use Case
    This integration is ideal for organizations that rely on the Palo Alto Networks security stack but prefer centralized administration within the Microsoft ecosystem. It delivers enterprise-grade security for mobile browsing while simplifying the IT workflow.

    Prisma Browser for Intune

    Prisma Browser for Intune is specifically designed for:
    • Organizations using Microsoft Intune as their MDM or MAM solution.
    • Enhanced integration with Intune"s App Protection Policies (APP).
    • Deeper integration with Microsoft Entra ID and Conditional Access.
    App Details
    Key Differences Between Prisma Browser for Mobile and Prisma Browser for Intune
    FeaturePrisma Browser for MobilePrisma Browser for Intune
    MDM SupportAll MDM ProvidersOptimized for Microsoft Intune
    App Protection PoliciesNot supportedFull Intune APP Integration
    Conditional AccessBasic IdP basisEnhanced Entra ID integration
    Android/iOS AppSingle AppSeparate "for Intune" app
    Prisma Browser for Intune App

    Use Cases

    1. Mobile Application Manager (MAM)
      • Default Browser Configuration: Configure Prisma Browser as the default for managed applications on unmanaged personal devices to ensure consistent security and compliance across web access.
      • Unified Policy Management: Extend existing Intune App Protection Policies to Prisma Browser for Intune. This eliminates the need for browser-specific policies, allowing centralized management of data protection, conditional access, and compliance rules directly within Intune.
      • Secure Browsing: Secure web traffic by tunneling it through Prisma Access, ensuring all corporate browsing requests remain protected, secure, and compliant.
    2. Mobile Device Management (MDM)
      • Single Browser Enforcement: Building on MAM capabilities, MDM allows organizations to designate Prisma Browser for Intune as the exclusive browser for corporate-managed devices. This ensures all web traffic is routed through a secure, controlled environment, guaranteeing full policy enforcement.
        This integration streamlines administration by centralizing policy management within Intune, reducing overhead while maintaining consistent security and a seamless user experience across devices.

    Step 1 - Grant Prisma Browser Permissions in Microsoft Intune

    This section outlines the steps required for a Microsoft Entra ID Administrator to authorize and provision the verified third-party mobile application, Prisma Browser (Palo Alto Networks Inc.), within the organization's tenant.
    App Details
    • App Name: Prisma Browser
    • Publisher: Palo Alto Networks Inc. (Verified)
    • Application (Client) ID: edc4bc6b-9e08-4c12-91dc-2a3421facd71
    Prerequisites
    To complete this process, you must have an account with one of the Entra ID directory roles mentioned earlier.

    Provisioning Process: Tenant-Wide Admin Consent

    Because Prisma Browser is a third-party application, it must be installed as an "Enterprise Application" (Service Principal) in your tenant before users can authenticate it. We will do this using a direct Admin Consent URL.
    1. Initiate the Consent Request
      1. open a web browser.
        Incognito or InPrivate window is recommended to avoid caching issues with existing sessions.
      2. Copy and paste the following Microsoft Admin Consent URL into your address bar. https://login.microsoftonline.com/common/adminconsent?client_id+edc4bc6b-9e08-4c12-91dc-2a3421facd71
    2. Authenticate and Review Permissions
      1. Press Enter.
        You will be prompted to sign into Microsoft. Use your administrator credentials.
      2. "Permissions requested" dialog box will appear. You will see "Prisma Browser" by Palo Alto Networks Inc., requesting the following permissions for your organization:
        1. Read and Write the User's App Management data.
        2. Sign in and read user profile.
    3. Handle the "Loading" Screen (Expected Behavior)
      .
      1. Review the permissions and click the Accept button at the bottom.
        Immediately after clicking Accept, your browser may appear to get stuck on a blank loading screen, or the page may spin indefinitely.
        This is expected behavior. Because Prisma Browser is a mobile application rather than a web application, it does not supply a web redirect URI for the browser to navigate to after consent is granted.
        Your consent was successfully recorded in the background. You may safely close the browser tab.
    4. Verification: Confirming the App is Provisioned
      To confirm the application has been successfully added to your directory:
      1. Log in to the Microsoft Entra Admin Center.
      2. In the left-hand navigation menu, go to > Enterprise apps.
      3. Critical Step: At the top of the application list, you will see a default filter applied:
        Critical Step: At the top of the application list, you will see a default filter applied: Application type == Enterprise Applications. Click the "X" next to this filter to remove it; you need to search for All Applications.
      1. In the search bar, type Prisma Browser or the App ID edc4bc6b-9e08-4c12-91dc-2a3421facd71.
      2. The application should now appear in the list, confirming it is ready for use in your tenant.

    Step 2 - Deploy Prisma Browser

    2.1 Deploy Prisma Browser for Intune on iOS.
    Microsoft Intune is a cloud-based endpoint management solution that can be used to deploy Prisma Browser onto iOS mobile devices.
    Add Prisma Browser for Intune App to Microsoft Intune.
    1. Launch Microsoft Intune Admin Center.
    2. Navigate to Apps > All apps, and click Create.
    3. .
    4. From the App Type dropdown, select iOS store app.
    5. Click Search the App Store and search for Prisma Browser for Intune.
    1. Choose the Prisma Browser app and click Select.
    2. The App information page is displayed - review the details.
    3. Click Next to display the Assignments page.
      Configure App Assignments
      Define the relevant group assignments for the app that fit your enrollment strategy:
      1. Select the appropriate Assignment Type and target groups.
      2. Click Next to display the Review + Create page.
      3. Review the App Summary and click Create to add the app to Intune.
      User Installation Options
      If the Assignment Type is set as not required, users will need to manually download Prisma Browser using one of the following options:
      Option 1: Intune Company Portal
        1. Sign in to the Intune Company Portal app with a user who is part of the assigned group.
        2. Select the Prisma Browser app.
        3. Click Install.
      Option 2: App Store
        1. Open the App Store on your iOS device.
        2. Search for Prisma Browser.
        3. Click Install.
      Step 2.2 Deploy Prisma Browser for Intune on Android
      For Android devices, Prisma Browser for Intune is deployed as a separate application from the standard Prisma Browser.
      Add Prisma Browser for Intune to Microsoft Intune.
        1. Launch Microsoft Intune Admin Center.
        2. Navigate to Apps > All apps, and click Add.
        3. From the App Type dropdown, select Android store app.
        4. Navigate to the App information page and add the relevant Field Values:
      2. Click Next to display the Assignments page.

    Step 3 - Configure App Protection Policies

    The Intune SDK integrated into Prisma Browser for Intune requires an App Protection Policy (APP) assignment as part of its mandatory initialization process. Upon application launch, the SDK verifies the assigned APP and applies the relevant security controls. This is a mandatory step for the application to complete enrollment and function as intended. Organizations must assign at least one APP policy to Prisma Browser for Intune before users can access the application.
    APPs are optional Intune policies that apply app-level controls to help protect organizational data within supported mobile applications. They can enforce requirements such as work credentials or PIN access, restrict data transfer between apps, and prevent data loss without requiring full device enrollment. Organizations may choose to utilize these policies when additional protection for corporate data is required, particularly in bring-your-own-device (BYOD) environments.
    Configuration Steps:
    1. Navigate to Apps within Intune console.
    2. Select Protection under the Manage Apps menu.
    3. Click +Create and select your platform (iOS/iPadOS or Android) from the drop-down.
      1. On the Basics page:
        • Name your app protection policy (e.g., "Prisma Browser for Intune - Data Protection - iOS").….. .
        • Provide a description.
        • Click Next to continue.
        1. On the Apps page:
          • Click + Select public apps.
          • Search for and select Prisma Browser for Intune .
          • Click Next
          Currently, Prisma Browser for Intune does not appear in the public app list (common in Apple Business Manager or Managed Google Play deployments). Adding the app to the public list is in the process. Use the custom app option instead and search using:
          • ….….….….….….….….….….….
          • iOS: com.talon-sec.work.ios.intune
          • Android: com.talonsec.intune.talon
        1. On the Data Protection page:
          • Configure data loss prevention policies (e.g., restrict copy/paste, prevent screenshots).
          • Click Next.
        1. On the Access requirements page:
          • Configure access policies (e.g., require PIN, biometric authentication).
          • Click Next.
        1. On the Conditional launch page:
          • Configure any applicable conditional launch settings (e.g., block access if device is jailbroken).
          • Click Next.
        1. On the Assignments page:
          • Assign the app protection policy to users or groups based on your company policies.
          • Click Next.
      7. Review the policy's settings and assignments, then click Create to complete.
      8. Repeat this process for the remaining operating system (if you need to configure both iOS and Android).
      Example Policy Configuration:
      For a typical BYOD deployment, consider these settings:
      • Data Protection: Restrict cut/copy/paste to managed apps only.
      • Access Requirements: Require PIN (minimum 4 digits) or biometric authentication.
      • Conditional Launch: Block access if device is jailbroken/rooted.
      • Assignments: Target all users or specific groups requiring mobile web access.

    Step 4 - Configure SSO Extension for Seamless Authentication (iOS only)

    The Microsoft Enterprise SSO plug-in provides single sign-on (SSO) capabilities to Prisma Browser for Intune, enabling seamless authentication to corporate web resources that use Microsoft Entra ID for authentication.
    Prerequisites
    • Microsoft Intune Admin Access — Administrator privileges in Microsoft Intune.
    • Device Requirements — iOS/iPadOS devices (iOS 13.0 or newer) enrolled in Intune.
    • Microsoft Authenticator App — Must be installed on the device.
    • Prisma Browser for Intune — Must be deployed to target devices (see Step 2).
    Create a Single Sign-On (SSO) Configuration Profile
    1. Launch Microsoft Intune and Create Profile
      1. Open the Microsoft Intune Admin Center (https://intune.microsoft.com
      2. Navigate to Devices > Configuration profiles.
      3. Click + Create profile.
    2. Define Profile Basics
      FieldValue
      PlatformiOS/iPadOS
      Profile TypeTemplates
      TemplateDevice Features
      • Click Create to Proceed.
    3. Enter Profile Name
      1. Enter a descriptive name (e.g., "Prisma Browser SSO - iOS/iPadOS").
      2. Click Next.
    4. Configure SSO App Extension
      1. Select Single sign-on app extension.
      2. Set SSO app extension type to Microsoft Entra ID.
      3. Set Enable shared device mode to Not configured.
    5. Add Extension Configuration Data
      In the Additional configuration section, add these key-value pairs:
      KeyType Value
      AppPrefixAllowListStringcom.apple., com.microsoft., com.talon-sec.work.ios
      browser_sso_interaction_enabledInteger1
      disable_explicit_app_promptInteger1
      Enable_SSO_On_All_ManagedAppsInteger1
      Click + Add for each entry.
    6. Assign Profile to Groups
      1. Click Next to proceed to Assignments.
      2. Click + Add groups and select target user or device groups.
      3. Click Select to confirm.
    7. Review and Create
      1. Click Next to review all settings.
      2. Click Create to deploy the SSO configuration profile.

    Understanding the MDM Key: Device Classification and Policy Differentiation

    What is the MDM Key?

    The MDM key is a unique configuration value that administrators generate in the Prisma Browser Management Console (SCM) and send to the device via the MDM console using the app configuration policy. This aims to distinguish between MDM-managed devices and unmanaged devices. This mechanism works with any MDM solution (Microsoft Intune, Jamf, VMware Workspace ONE, etc.).
    For more information, please see Enforce Prisma Browser for Mobile Access on Managed Devices Using MDM App Configuration.

    Getting Help

    If you encounter any issues or have questions that aren't covered in this guide:

    © 2026 Palo Alto Networks, Inc. All rights reserved.