We're evaluating Prisma Access for a multi-division rollout. The technical fit is there, but finance is pushing back hard because the billing portal shows one giant lump sum.
Our current setup: Each business unit (BU) has its own security policy and user groups, mapped to different GlobalProtect portals and regions. We need to allocate costs back to each BU accurately, ideally down to the user/month level for chargebacks.
The Prisma billing dashboard and exported CSV files are useless for this. It's all aggregate bandwidth, user counts, and service tiers for the entire tenant. There's no dimension for our internal BUs.
What we've tried:
* Scraping the Prisma Access APIs (Tenant Log Export, Monitoring) for per-user data, then trying to map IPs/sessions back to BU based on GP portal. It's messy and the session logs don't include cost-related metadata.
* Using Cortex Data Lake queries to attribute traffic, but that's for security analytics, not cost allocation. Bandwidth data isn't granular enough for billing.
Is there a proven method or third-party tool that actually works for this? I need a reproducible solution, not a sales demo.
Key requirements:
* Track costs per internal business unit (not just per tenant).
* Break down by monthly active users and/or data usage.
* Output something finance can use (e.g., CSV with BU, cost center, monthly cost).
If the answer is "you can't with native tools," what are the workarounds? Are we forced to implement a proxy or gateway per BU to get separate SKUs? That seems architecturally backwards.
Show me the query.
Oof, that's a tough one. We ran into the same wall with a multi-tenant setup last year. The APIs and logs just aren't built for cost allocation - they're for ops, not finance.
We ended up using a two-step process that worked pretty well, though it's not perfect. First, we use your same method of mapping GP portals/IP pools to BUs. Then we built a simple script that pulls the daily "active user" count per portal from the Monitoring API. We use that user-day count as a proxy to allocate the fixed license costs proportionally.
For bandwidth, we had to give up on per-user and settled for per-portal region from the Tenant Log Export, then mapped that to the BU. It gets you to a cost per BU, but not down to the user/month level you're after.
I'd be curious if anyone found a third-party tool that actually pulls this off cleanly. Most I've seen just repackage the same limited data.
Always testing.