Prisma Browser
Prisma Browser tests how to give unmanaged and BYOD users zero trust access to SaaS and private apps without installing a full network agent. It is a browser-based enforcement point, not a VPN replacement for managed endpoints.
Core rules
- Access is delivered through an enterprise browser session; the IdP authenticates the user, and Prisma Browser applies policy to the session.
- It extends SASE controls to contractors and unmanaged devices: view-only access, clipboard restrictions, download/upload blocking, printing controls, watermarking, and session isolation.
- It protects against phishing and credential theft by keeping corporate credentials and sessions away from the personal browser context.
- Private apps can be published through Prisma Access/ZTNA; SaaS apps use SAML/SSO integration.
- Policy is identity- and app-centric, not network-centric. No inbound exposure is required.
Worked example
A contractor on a personal laptop needs Salesforce. The admin publishes Salesforce through Prisma Browser, requires IdP MFA, and applies a rule that blocks downloading reports and copy/paste of customer data. The contractor logs in through the browser; Salesforce sees the IdP identity. The contractor can view records but cannot export them. Reasoning: the control is enforced in the browser session, so it works without an agent on the unmanaged device.
Traps
- Confusing Prisma Browser with GlobalProtect/Prisma Access Agent.
- Expecting full network-layer control on a personal device.
- Assuming Browser replaces all DLP channels.
- Forgetting the IdP/SSO dependency.
- Treating browser isolation as equivalent to a full remote-access VPN.