Get Started with OIDC SSO

Prisma Cloud offers a Service Provider (SP) initiated SSO capability. Leveraging OpenID Connect (OIDC), this option enables Prisma Cloud System Administrators to allow users to sign in to Prisma Cloud with their Identity Provider (IdP) credentials using the Sign in with OIDC SSO option on the login page. Learn more about setting up SP-initiated SSO below.

To avoid account lockout while making configuration changes, enable administrative users to log into the console with both local authentication credentials on Prisma Cloud and SSO access by adding them to the SSO bypass list.

The Sign in via SSO button enables login with a configured OIDC SSO provider. To sign in using third party Security Assertion Markup Language (SAML) SSO, use the Identity Provider defined for the SAML integration with the Prisma Cloud tenant.

Complete the steps below on the Prisma Cloud console and your IdP to set up OIDC:

1. Log in to Prisma Cloud using an account with System Administrator privileges to configure SSO and redirect login requests to the IdP’s login page.
2. Complete the following steps on your Prisma Cloud tenant:

   1. Select Access Control > SSO and select OIDC as shown below.

      
   2. Copy the Audience URI value. This is a read-only field in the format that uniquely identifies your instance of Prisma Cloud. This value is required to configure OIDC on your IdP.

      tt:[NOTE:] The Prisma ID of a tenant is displayed adjacent the OIDC configuration so that it can be shared with users that may have access to multiple tenants. If you have access to multiple tenants on a stack you will be required to enter the Prisma ID of the tenant you are logging into.
3. Complete the setup on the IdP.

   1. Review the workflow for your IdP.

      • Okta
      • Azure AD
4. Add the Callback URI previously created on Prisma Cloud to the IdP.

Use your pre-defined Access URL for login, alternatively use your federated login URL.