The Atlas take.
Prisma Access is a substantial candidate for teams moving internet and private-access policy toward a cloud-delivered service, especially where Palo Alto operations already exist. The licensing documentation deserves as much attention as the architecture diagram: the edition, mobile-user scope and management experience shape the actual deployment. Atlas would insist on a complete private application transaction and an internet-policy test before crediting a combined solution. Secure Agentless Access is a separate evaluation path with its own prerequisites, rather than a capability to assume from the broad Prisma Access name.
02 / DEFINE THE BOUNDARY
What you are actually evaluating.
For a combined public/private evaluation select the Enterprise secure-all-apps edition and required mobile-user scope. Strata Cloud Manager and Panorama management differ; RBI and Secure Agentless Access add-ons must be identified separately.
03 / THE CONTROL PATH
Where it sits. How it works.
Atlas architecture interpretation: onboard selected users or sites to cloud policy enforcement, then connect internet and private destinations through the documented architecture for the purchased edition.
- 01
Mobile users or site connectivity
Select the supported client, tunnel and identity integration for the intended population.
- 02
Prisma Access policy and management
Use the chosen management experience and licensed inspection/access functionality.
- 03
Public or private application outcome
Verify application reachability and investigation evidence, including separate agentless prerequisites when selected.
04 / WHAT EARNS ITS PLACE
Strengths, with the evidence attached.
Atlas analysis of documented capabilities; availability and behavior depend on the edition and environment.
Licensing is documented by capability
The license guide supports a concrete edition-to-requirement map rather than an undifferentiated platform comparison.
Agentless prerequisites can be tested
Dedicated Secure Agentless Access documentation helps buyers examine the alternative access path before promising it to contractors.
Inspect the documented capability notes
- License editions distinguish secure internet, private application and combined access.
- GlobalProtect supports endpoint-based mobile-user access in the relevant deployment.
- Secure Agentless Access offers supported browser access with version, identity and add-on requirements.
05 / KNOW THE COMPROMISES
The tradeoffs to take seriously.
Architectural implications and procurement questions from Atlas; these are not independently measured product failures.
Management choice affects operations
Confirm the selected Strata Cloud Manager or Panorama workflow, entitlement and deployment guidance before planning migration.
Private web access has prerequisites
Agentless private application documentation describes additional requirements; do not assume every private protocol or device fits that path.
06 / FROM PURCHASE TO PRACTICE
Make it work in your environment.
A proposed implementation sequence. Confirm supported versions, permissions, and rollback with the current documentation.
- 01
Freeze the proposed bill of materials
Record edition, mobile-user scope, management plane and any agentless or isolation add-ons.
- 02
Map application dependencies
Include authentication redirects, helper services and name resolution in the private-access pilot.
- 03
Plan publish and rollback ownership
Document who changes policy, how the effective result is verified and how access is restored after an error.
07 / THE OPERATING COMMITMENT
The bill is only part of the cost.
Commercial shape
Compare the exact edition and capacity or user scope in the quote. Separate agentless access, browser isolation and other add-ons from the combined baseline, including required connectivity infrastructure.
- Selected edition and user/site scope
- Management and optional access entitlements
- Connectivity, migration and policy operations
08 / COMPARE THE JOB
Put these beside it.
Alternatives worth examining for the same problem. Check each offering’s scope before treating it as a substitute.
Zscaler Internet & SaaS and Private Access
Compare the ZIA/ZPA split and connector model against the chosen Prisma combined-access configuration.
FortinetFortiSASE
Compare client, private-connectivity and policy-update behavior for a Fortinet-oriented operating environment.
09 / MAKE THE DECISION OBSERVABLE
Earn confidence through a real evaluation.
Suggested by Atlas. Agree acceptance criteria, use synthetic fixtures in an authorized environment, and capture both useful work and failed controls.
- TEST 01
Complete a private application transaction
Acceptance evidence: Preserve identity, DNS, dependency and effective-policy evidence.
- TEST 02
Apply and reverse an internet restriction
Acceptance evidence: Record publication timing, matching rule and user outcome.
- TEST 03
Pilot a separately licensed agentless application
Acceptance evidence: Check the documented prerequisites and record unsupported workflows explicitly.
START WITH ONE EXERCISE
A contractor uses a browser to reach a private training application.
Evidence to look for: List the exact service version, identity integration, connection path and optional isolation license before claiming that an unmanaged-device demo represents the purchased service.
Questions to bring to the vendor
- Which policy capabilities disappear if the edition does not support them?
- Which dataplane and service versions are required for agentless access?
- Are private-app connectivity and optional data controls in the proposed design?
10 / SHOW THE WORK
Evidence, and what is still unknown.
What this research cannot establish
- Atlas has not independently tested latency, availability or inspection efficacy.
- Confirm edition-specific capabilities and the exact management/deployment release.
Dossier research reviewed October 18, 2026. Earlier profile references are retained for traceability; products and commercial terms change.
- Prisma Access licensing ↗Documentation
- Secure Agentless Access ↗Documentation
- Private web application prerequisites ↗Documentation
KEEP BUILDING YOUR JUDGMENT