> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/setup-sso-integration-on-prisma-cloud/get-started-with-saml-sso/setup-adfs-sso-on-prisma-cloud.md).

# Set up ADFS SSO on Prisma Cloud

To secure administrator access to Prisma Cloud, go to ADFS to configure single sign-on (SSO) and then configure Prisma Cloud for SSO.

Active Directory Federation Services (AD FS) is a service provided by Microsoft as a standard role for Windows Server that provides a web login using the existing Active Directory (AD) credentials.

To avoid account lockout, you must enable a few administrative users with both local authentication credentials on Prisma Cloud and SSO access. Ensure that each administrator has activated their Palo Alto Networks Customer Support Portal (CSP) account using the Welcome to Palo Alto Networks Support email and set a password to access the portal.

1. Decide whether you want to first add Administrative users On Prisma Cloud or you prefer to add users on the fly with JIT Provisioning when you set up ADFS SSO on Prisma Cloud.

   If you want to enable JIT provisioning for users, create Prisma Cloud Roles before you continue to the next step. When you configure SSO on AD FS, you must attach this role to the user‘s profile so that the user has the appropriate permissions and can monitor the assigned cloud accounts on Prisma Cloud.
2. Copy the Audience URI, for Prisma Cloud, which users need to access from AD FS.
   1. Log in to Prisma Cloud and select **Settings > SSO**.
   2. Copy the **Audience URI (SP Entity ID)** value. This is a read-only field in the format: <https://app.prismacloud.io?customer=\\><string> to uniquely identify your instance of Prisma Cloud. You require this value when you configure SAML on AD FS.
3. Set up AD FS for SSO.
   1. Before you begin to set up the AD FS configuration, login to your Prisma Cloud account and copy the **Audience URI (SP Entity ID)** from Prisma Cloud as described in Step 2.
   2. Login to AD FS as an Administrator and [Create a SAML SSO](https://docs.microsoft.com/en-us/powerapps/maker/portals/configure/configure-saml2-settings) Prisma Cloud application.
   3. Under the **Identifiers** tab, enter the relying party URL, for example: <https://app.prismacloud.io/>

      Depending on the location of your tenant, which is displayed in the login URL, replace ‘app’ with ‘app2’ or ‘app.eu’, for example: <https://app.eu.prismacloud.io/>

      Remember to enter the forward slash at the end of the URL.

      <figure><img src="/files/mVi3vgfGtcB3bXPbBiRp" alt="adfs sso setup 3"><figcaption></figcaption></figure>
   4. Under the **Endpoints** tab, enter the Assertion Consumer Service (ACS) URL, for example: <https://api.prismacloud.io/saml>

      Depending on the location of your tenant, which is displayed in the login URL, replace ‘api’ with ‘api2’ or ‘api.eu’, for example: <https://api.eu.prismacloud.io/saml>

      You can also add the logout endpoint.

      <figure><img src="/files/eOZxOY3oDFalDLKLhWZS" alt="adfs sso setup 1"><figcaption></figcaption></figure>
   5. Use a transform rule to pass the email address as the NameID attribute and click **OK**.

      <figure><img src="/files/5M0XhzZrtOh9Wr3Pmo2k" alt="adfs sso setup 2"><figcaption></figcaption></figure>
4. Configure AD FS on Prisma Cloud.
   1. Log in to Prisma Cloud and select **Settings > SSO**.
   2. **Enable SSO**.
   3. Enter the value for your AD FS Issuer.

      The Issuer URL is part of the assertion, for example: <https://adfs.domain.com/adfs/services/trust>
   4. Enter the **Identity Provider Logout URL**.

      A user is redirected to this URL when Prisma Cloud times out or when the user logs out.
   5. Enter your AD FS **Certificate** in the PEM format.

      The certificate is used to verify that the assertion is signed correctly.
   6. Enter the **Prisma Cloud Access SAML URL** configured in your AD FS settings, for example: <https://adfs.domain.com/adfs/ls/idpinitiatedsignon.aspx?logintorp=https://app.prismacloud.io>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/administration/setup-sso-integration-on-prisma-cloud/get-started-with-saml-sso/setup-adfs-sso-on-prisma-cloud.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.