Hey folks! Ran into a real head-scratcher this week while setting up Prisma Access for our mobile/remote workforce. I think I made a classic beginner mistake around licensing, specifically with how **license pools** work for mobile users. Sharing here so others can avoid the same trap! 😅
We had 100 `Prisma Access Mobile Users` licenses. I assumed that if I created a `Mobile Users` group in the portal and assigned all 100 licenses to it, that would cover our team. The confusion started when I saw the `License Pool` dropdown during the mobile user configuration.
Here’s the kicker: **The license pool you select isn't about assigning licenses TO the group. It's about pulling licenses FROM a pool you've already configured.** So you need to create the license pool first, allocate your total count there, and *then* select that pool when setting up your mobile user groups.
For example, here’s the step I missed in the portal:
1. **Go to Panorama (or the cloud admin portal) → `Tenants` → `Licenses`**.
2. Create a new license pool (e.g., `Mobile-Pool-All`), assign your 100 Mobile User licenses to it.
3. **Then**, when you configure your mobile user group (`Config` → `Mobile Users`), you select that `Mobile-Pool-All` from the dropdown.
If you don't do step 2 first, the dropdown in step 3 is empty, and you can't proceed. I was trying to assign licenses directly in the mobile user group config, which doesn't work. The pool acts as a central reservoir.
Lesson learned: Think of license pools as "license buckets" that you draw from. It’s a two-step process: fill the bucket first, then dip into it. Hope this saves someone a few hours of confusion!
Has anyone else stumbled on this? Or have best practices for structuring multiple pools (like by department or region)? I’m curious how others are managing it.
Clean code, happy life
Ohhh I totally get this now. That "License Pool" dropdown had me confused too. I was thinking the same way, like I was assigning licenses *to* something, not pulling *from* something. Your step-by-step is super clear, thanks for that!
One quick question, if you don't mind. Does this mean one license pool can supply multiple different mobile user groups? Like, could I have a "Mobile-Pool-All" of 100 licenses, and then have both a "Sales-Mobile" group and "Engineering-Mobile" group pulling from that same pool? That would make sense for shared resources.
Exactly. That's a common point of confusion. The license pool is a separate, pre-provisioned resource bucket.
People often miss the sequence. You allocate licenses *before* you have any users configured. The pool needs to exist and have a count.
Fail to do that and the mobile user group configuration will show an empty dropdown, or a pool with zero available licenses, stopping deployment.
Five nines? Prove it.
Exactly right, that's how it works. One pool feeds many groups. That shared bucket model is the whole point, otherwise you'd be stuck with static, inflexible allocations.
Just remember the pool's total is a hard ceiling. If your "Mobile-Pool-All" has 100 licenses, then Sales-Mobile and Engineering-Mobile *combined* can't exceed 100 active users. You won't get a warning when configuring the second group, it'll just fail at runtime when the licenses are exhausted.
I've seen teams get bitten by assuming they could oversubscribe, like having two groups each set to need 75 users, thinking it's "potential." The system doesn't care about your intent, only the license count at connection time.
APIs are not magic.