Let's cut through the marketing speak. Palo Alto's licensing model for Prisma Access is a common point of confusion, and getting the 'Mobile User' vs. 'Remote Network' definitions wrong can blow up your projected costs or leave you with a non-compliant deployment. I've seen teams accidentally license hundreds of contractor devices as 'Remote Networks' because they misunderstood the distinction, creating a six-figure surprise at renewal.
Based on my implementation across three enterprise environments, here is the operational reality:
**A 'Mobile User' license covers:**
* Any device that runs the GlobalProtect client software for user-initiated connectivity. This is the key.
* Primary use case: Laptops, smartphones, and tablets used by employees, contractors, or third parties to access corporate resources.
* The connection is established *from* the device *to* Prisma Access. The device itself is the security endpoint.
* Example: Your developer working from a coffee shop on their MacBook. The VPN tunnel originates from the GlobalProtect client on that MacBook.
**A 'Remote Network' license covers:**
* A fixed site or network segment that establishes an always-on or on-demand tunnel *from* a security appliance (physical or virtual) *to* Prisma Access.
* Primary use case: Branch offices, retail locations, or data center egress points where you place a Palo Alto Networks NGFW (VM-Series, PA-220, etc.).
* The tunnel originates from that network's firewall, not from an individual user's client. All traffic from that site is aggregated through that single tunnel.
* Example: Your regional office with a PA-440. That firewall establishes an IPSec tunnel to Prisma Access, and all users in that office route through it *without* needing the GlobalProtect client.
The critical technical differentiator is the tunnel termination point and initiating entity. If the tunnel starts at a user-space client on an OS, it's a Mobile User. If the tunnel starts from a dedicated network security platform, it's a Remote Network.
A practical grey area: So-called 'always-on' GlobalProtect clients on corporate laptops. These are still **Mobile Users**. The 'always-on' is a client configuration, but the tunnel still initiates from the GP client on the endpoint OS. Do not mistakenly count these as site-to-site Remote Networks.
Misconfiguration Example: I once reviewed a setup where a team tried to use a 'Remote Network' license for a cloud-based call center by deploying a VM-Series in a cloud VPC. That was correct. However, they then also allowed those call center agents to take their VDI instances home and connect via the GlobalProtect client. Those home connections needed **additional Mobile User licenses**, which they had not procured. This created a compliance gap.
Always map your licenses to the actual tunnel origination as defined in your infrastructure code. For instance, your Terraform for a Remote Network will explicitly define a `prisma_remote_network` resource or similar, pointing to your VM-Series ID. Your Mobile User deployment will be defined in your client configuration management (e.g., an Intune profile or a Chef cookbook deploying the GlobalProtect client settings).
-- as