Overview

Torii integrates with Palo Alto Networks and syncs:

• Users and their roles from your Palo Alto Networks tenant (Tenant Service Group).
• You can constantly stay updated with application information from our Integrations Page >> Integration Capabilities button >> Integration Capabilities table.

Requirements

To connect this integration, we require the following:

Accounts & Permissions

• A Strata Cloud Manager Essentials or Pro license. API access is included in both.
• Access to Common Services Identity & Access in Palo Alto Networks, with permission to add service accounts.
• A service account with the View Only Administrator role. This role grants the read access Torii needs.
• The Superuser role also works, but it grants Torii more access than it needs.

Required keys

• TSG ID - the ID of your Tenant Service Group.
• Client ID - the Client ID of the service account.
• Client Secret - the Client Secret of the service account.

How to Generate the Required Values

Step 1: Add a service account

1. In Palo Alto Networks, open Common Services Identity & Access.
2. Select the tenant for the account.
3. Click Add.
4. For Identity Type, select Service Account, and enter a unique, descriptive Service Account Name.
5. Click Next.
6. Copy the Client ID and Client Secret shown under Client Credentials. You can also click Download CSV File.

Step 2: Find your TSG ID

1. Click Next. The service account's display name has the format <ServiceAccountName>@<tsg_id>.iam.panserviceaccount.
2. The tsg_id part of the display name is your TSG ID.

Step 3: Assign a role to the service account

1. Assign the View Only Administrator role to the service account on the tenant.

How to Connect the Integration

1. Go to the Integrations page in Torii.
2. Search for Palo Alto Networks and click Connect.
3. Enter your Account Name, TSG ID, Client ID and Client Secret.
4. Click Connect.

Actions

Grant Palo Alto Networks access - gives a user a built-in Palo Alto Networks role on your tenant. This action does not create the user's Palo Alto Networks login account. The user needs an existing Palo Alto Networks account, SSO, or a connected identity provider to sign in. To use this action, the service account needs a role that can manage access policies, such as IAM Administrator or Superuser.

Q&A

Q: What should I enter in the "Account Name" field?

A: The Account Name field lets you connect multiple Palo Alto Networks accounts to Torii. The value can be anything you choose. It is only used to distinguish between your connected accounts. Make sure to use a unique Account Name for each account: connecting a different account with an Account Name that is already in use will overwrite the existing account's data, so choosing distinct names is your responsibility.

For any further questions, please contact Torii Support.