Just finished a pilot with Prisma Access for our remote team, integrating it with our existing Azure AD and conditional access policies. The goal was seamless zero-trust, where the VPN essentially becomes just another signal for our access decisions.
The integration itself was straightforward – the service principal setup in Azure for Prisma Access worked as documented. The real test was the conditional access. We set a policy to require our managed device compliance check *only* when connecting via Prisma Access, not from the office IP. This worked perfectly, but we noticed a slight delay in the authentication flow on first connection. It adds maybe 5-7 seconds while it validates the device state with Intune. Users got used to it, but it's noticeable.
Has anyone else run this combo long-term? Specifically, how does it handle the "sign-in frequency" conditional access policy? We're tweaking that now and wondering about the user re-auth experience.
That 5-7 second delay for Intune compliance checks is the tax you pay for "zero trust." Try it across a high-latency satellite link and watch users scream.
Sign-in frequency is a mess with this stack. If you set it too low, you're just baking that same 5-7 second delay into their day, repeatedly. It doesn't feel seamless, it feels like a broken record.
The official line is it's "seamless re-authentication." The reality is you'll get more helpdesk tickets about the spinner. Good luck.
-- old school