Overview

Palo Alto Prisma Browser Inspector (Beta)

Palo Alto Prisma Browser is a secure enterprise browser that governs which websites and AI applications users can reach and which data-handling controls apply — such as blocking uploads, copy/paste, and downloads. The Palo Alto Prisma Browser Inspector (Beta) connects to the Prisma Browser Partner Provisioning API, discovers every customer tenant your MSP manages, and reports each tenant's lifecycle status, SSO configuration, user roster, website security and content filtering, and data-loss-prevention (DLP) controls back into Liongard — so you can spot coverage gaps and policy drift without opening the Prisma Browser console for each customer.

What you can monitor

The Palo Alto Prisma Browser Inspector collects partner-level and per-tenant data, including:

• Tenant inventory and lifecycle status (active, under review, suspended)
• SSO configuration status
• Provisioned users and admin users
• Subscription type and trial end date
• Default and additional content-filter categories, and individually blocked websites
• DLP data control rules, including rules with a protection disabled
• Declared business vertical

How it works

A parent launchpoint holds your MSP's partner-level API credentials and discovers every customer tenant provisioned under them. Liongard creates a child launchpoint for each tenant, mapped to its own Liongard Environment, so browser security posture can be tracked independently per customer.

Benefits

• Validate that every customer's Prisma Browser configuration matches your security baseline.
• Detect policy drift — changes to content-filter categories, blocked websites, and DLP rules, weakened DLP rules, and tenants without SSO — as change events.
• Keep an evidence trail of browser and AI-governance configuration over time to prove value in QBRs and security reviews.
• Catch tenants that move to under review, suspended, or rejected, and see each trial's end date before protection lapses.
• Track changes in admin and provisioned user counts across your customer base.

Inspector Setup Preparation

Step 1: Obtain Partner API Credentials

1. Contact your Palo Alto Networks partner representative to request Prisma Browser Partner Provisioning API access for your MSP.
2. Once access is granted, get all four values from Palo Alto Networks: Partner Provider Slug, Auth0 Client ID, Auth0 Client Secret (shown only once when it's created), and Auth0 Tenant Domain.
3. Store the credentials securely — you'll enter them when configuring the parent Inspector.

Inspector Setup:

Step 2: Configure the Palo Alto Prisma Browser Inspector in Liongard

1. Log in to the Liongard platform.
2. In Liongard, navigate to Admin > Inspectors > Inspector Types > Navigate to the Palo Alto Prisma Browser Inspector > Select Add System.

Since Prisma Browser is a multi-tenant system where a single partner credential manages many customer tenants, you'll set up a single "Parent" Inspector that will then auto-discover a "Child" Inspector for each tenant.

Fill in the following information:

• Type of Inspector: Parent
• Environment: Select your MSP's Environment
• Friendly Name: Suggested Naming: [MSP Name] Palo Alto Prisma Browser Parent
• Agent: Select the On-Demand Agent
• Inspector Version: Latest
• Partner Provider Slug: The provider slug Palo Alto Networks assigned to your MSP
• Auth0 Client ID: The partner-level Client ID from Step 1
• Auth0 Client Secret: The partner-level Client Secret from Step 1
• Auth0 Tenant Domain: The Auth0 domain from Step 1, for example https://your-tenant.auth0.com
• Scheduling: The Inspector will default to run once a day at the time it's set up. Here you can adjust the schedule
• Select Save. The Inspector will now be triggered to run within the minute.

Step 3: Child Inspector Setup

After the first run of the Parent Inspector, each customer tenant will be auto-discovered and surfaced in the Discovered Systems tab on the Inspectors > Palo Alto Prisma Browser Inspector page. Liongard suggests an Environment for each tenant based on its company name. Deprovisioned tenants aren't discovered. They still appear in the parent's Tenants list and count toward Total Tenants, so Total Tenants can be higher than your number of child launchpoints.

• Activate or Archive your Discovered Systems by ensuring they're mapped to the correct Environment > Check the checkbox to the left of Inspector(s) > Select the Actions drop-down menu > Activate Launchpoints (or Archive Launchpoints).
• Click Save.

The Palo Alto Prisma Browser Inspector ships 11 alert rules. All are disabled by default, so enable the ones you want to use. See the Palo Alto Prisma Browser Inspector Summary for the full list.

Troubleshooting

• Setup error on the first run (HTTP 401 or 403 from the OAuth2 token request): The Auth0 Client ID or Client Secret is mistyped, expired, or revoked. Confirm the credentials with Palo Alto Networks and re-enter them.
• "Unable to reach the Palo Alto Prisma Browser OAuth2 token endpoint": The Auth0 Tenant Domain is wrong, or your network blocks it. Check the domain Palo Alto Networks gave you, and confirm the agent can reach it over HTTPS.
• No tenants discovered: The credentials aren't partner-level, or no customer tenants are provisioned under your partner account. Confirm with Palo Alto Networks that the credentials have Partner Provisioning API access.
• A tenant's Website Security or Data Controls view is empty: Palo Alto hasn't granted that capability for the tenant. The inspector skips that section and collects the rest. If categories show as IDs instead of names, the content-filter catalog wasn't available for that tenant.
• The run fails with a server error (5xx): Palo Alto's service was unavailable. The inspector retries automatically. If it still fails, the previous inspection's data stays in place and the next scheduled run tries again.
• Slow runs or transient failures on large partner accounts: The Partner API allows 120 requests per minute. The inspector backs off and retries automatically when it's rate limited.

Inspector FAQs