Prisma Access is the Palo Alto Networks cloud-delivered secure access service edge (SASE) service. Its infrastructure runs on AWS, Google Cloud and Oracle Cloud Infrastructure, with more than 150 points of presence and compute locations.[2] It is licensed as a term subscription with three pricing meters: per user per year for remote workforces and mobile users, per site per year for branches, and per bandwidth (Mbps) per year for bandwidth shared across branches.[2] The licence edition decides which security capabilities are available. If a tenant uses capabilities in rules or profiles that its edition does not support, Prisma Access removes those configurations and does not enforce them until the licence is upgraded.[1] Like every Palo Alto Networks product, Prisma Access is governed by the End User License Agreement.[6]
Editions
Prisma Access is sold in three base editions:[1][2]
| Edition | Use case (vendor wording, summarised) | Private application access | Security services |
|---|---|---|---|
| Secure Web Gateway | Secure internet access for users and branches | Not included | Advanced Threat Prevention, Advanced WildFire, Advanced URL Filtering, Advanced DNS Security |
| Zero Trust Network Access (ZTNA) | Secure private application access | 5 service connections and 10 ZTNA connectors | Advanced Threat Prevention, Advanced WildFire |
| Enterprise | Internet and private apps, with enterprise browser and SaaS inline data protection | 5 service connections and 10 ZTNA connectors | All of the above plus SaaS Inline Security and Prisma Browser Core |
All editions include access to over 150 cloud locations, the Prisma Access Service Level Agreement, 250 GB of annual data transfer, management through Strata Cloud Manager or Panorama, and connection through GlobalProtect, Prisma Agent, Explicit Proxy and IPsec tunnels (rule).[2] Add-ons include Private App Access (up to 200 connectors), Strata Cloud Manager Pro, App Acceleration, App Security, SaaS Inline, AI Access, Data Loss Protection, Data Security, SSPM, Email DLP, Endpoint DLP, Prisma Browser Core and Pro, Privileged Remote Access, Remote Browser Isolation, Traffic Replication, IoT, Colo-Connect, Interconnect and Strata Logging Service.[2] Some older Prisma Access SKUs are End-of-Sale, and Palo Alto Networks migrates them to alternative SKUs.[1]
Metrics
- Prisma Access Mobile User: “For mobile user deployments, a unit is defined as one mobile user.”[1]
- Prisma Access Remote Network bandwidth (Mbps): “For remote networks deployments, a unit is defined as 1 Mbps.”[1]
- Prisma Access Remote Network site: site-based licensing introduced with Prisma Access 6.0, with predefined capacities from 25 Mbps to 2.5 Gbps.[3]
Counting / floors
Mobile users
One Mobile User unit lets a user connect with GlobalProtect, Explicit Proxy or both. Users who reach applications through Clientless VPN also count as a unit.[1] The service does not strictly police the count, but it tracks the number of unique users over the last 30 days to check the purchased tier and may enforce stricter policing after continued overages (rule).[1] The count is therefore a rolling unique-user measure rather than a named assignment. Under the EULA, overuse of user-based products can be trued up at the end of each month, quarter or year.[6] For the general concept see Named user licensing.
Remote networks: aggregate bandwidth
Aggregate-bandwidth licences are counted in 1 Mbps units and allocated to Prisma Access compute locations for branch connections (rule).[1] The Licensing Guide positions this meter for shared bandwidth capacity across branches.[2]
Remote networks: site-based
Site-based licensing needs Prisma Access 6.0 or later and removes the need to preallocate bandwidth to compute regions or configure redundancy by hand.[3] The site types are:
| Site type | Licensed bandwidth |
|---|---|
| Very Small | up to 25 Mbps |
| Small | up to 50 Mbps |
| Medium | up to 250 Mbps |
| Large | up to 1 Gbps |
| X-Large | up to 2.5 Gbps |
Licensed site bandwidth is the sum of ingress and egress. It is enforced by site type with 10% oversubscription, and a site above its limit may see degraded performance (rule).[3] Every site licence includes egress NAT and regional redundancy at no extra charge. For more than 2.5 Gbps, a location can be onboarded as several 2.5 Gbps sites, but that model does not support access to private applications.[3] The per-site meter also includes a Prisma SD-WAN branch subscription with select hardware models, depending on the Site License tier bought.[2]
Term and expiry
Prisma Access is a term-based offering with no grace period. Its term starts on the email delivery date of the authorization codes.[5] After a licence expires, the service keeps running and collecting logs for 15 days, but configuration cannot be changed. Instances shut down 15 days after expiry, and instances and tenants are deleted completely 30 days after expiry (rule).[1]
Virtualization & partitioning
Not applicable. Prisma Access is a cloud service licensed by users, bandwidth or sites, not by processors or hosts.
Cloud / BYOL
Prisma Access runs on the vendor’s own multicloud infrastructure, so there is no BYOL mapping.[2] Two other licences are required. Strata Cloud Manager Essentials is free with Prisma Access and Strata Cloud Manager Pro is an add-on.[4] Strata Logging Service is required, because Prisma Access stores its logs there, and its instance must be in the same region as the Prisma Access instance (rule).[1] Prisma Access managed by Panorama also needs a Panorama with a valid support licence, and its auth code must be tied to a licensed Panorama serial number. Cloud Identity Engine is free.[1]
Customers that licensed Prisma Access with ADEM and Strata Logging Service with sized storage before the new tiers were migrated at no additional cost to Strata Cloud Manager Pro for Prisma Access, with Strata Logging Service with one year retention. The migrated licences keep the original expiry dates.[4]
Programs
Prisma Access is excluded from the Enterprise Program for Attached Subscriptions, and Palo Alto Networks may charge for ADNS Resolver used with Prisma Access instances. However, ELA customers on terms of three years or more can apply Pro-rated Credits, worth 80% of unused Attached Subscription value, to Prisma Access mobile users and remote networks SKUs.[7] The PAA Attached Subscription in the ELA covers Prisma Access Agent and GlobalProtect Gateway on hardware firewalls.[7] The Licensing Guide also lists Deployment Services and Premium Customer Success.[2]
Out of scope
This article does not cover Prisma SD-WAN appliance licensing, Prisma Access China, FedRAMP variants, multitenant service-provider licensing, list prices, or the service level agreement itself.