How to Migrate Off Prisma Access: A Step-by-Step Guide for 2025
.webp)
Most Prisma Access migrations don't fail on the new product. They fail on the inventory. Teams discover halfway through that a branch tunnel, a PAC file, or a private app nobody documented was quietly riding on Prisma Access the whole time. This guide walks through a Prisma Access migration in the order that avoids those surprises: inventory, end state, policy mapping, pilot, rollout, and rollback.
Updated for 2027. Facts current as of October 2026.
If you're still deciding whether to leave, start with what Prisma Access is and our list of Prisma Access alternatives. This post assumes you've decided and want a plan.
What changed at Palo Alto in 2026 (and why it matters for timing)
A few changes affect when and how you migrate:
- The endpoint agent is changing anyway. Palo Alto positions the Prisma Access Agent as the successor to the GlobalProtect app, and its 2026 documentation increasingly calls it Prisma Agent. The two can coexist during a transition, but only one can be connected to Prisma Access at a time. If you're staying, you're redeploying an agent. If you're leaving, you're also redeploying an agent. Either way, budget for an endpoint rollout.
- The release line moved to 6.2. Prisma Access documentation lists 6.2 as the current release, managed from either Strata Cloud Manager or Panorama with the Cloud Services plugin.
- The browser got a new name. Prisma Access Browser is now Prisma Browser. If you deployed it for contractors or unmanaged devices, treat it as its own decision.
- The platform keeps growing. Palo Alto closed its CyberArk acquisition on February 11, 2026, and in March 2026 it pitched Prisma SASE for the agentic AI era. More platform can be a plus. It can also mean more SKUs to untangle at renewal.
Step 1: Inventory what Prisma Access actually does for you
Prisma Access is a bundle. Before you pick a destination for anything, list every job it does today. Pull this from Strata Cloud Manager or Panorama, plus your MDM and firewall configs.
| Prisma Access component | What it does today | Where it goes after migration |
|---|---|---|
| Mobile Users: internet traffic | Tunnels laptop web traffic to a Prisma Access location for SWG, URL filtering, and decryption | dope.security agent on the device inspects and enforces locally, then traffic goes direct |
| Mobile Users: private apps | GlobalProtect or Prisma Access Agent reaches internal apps and data centers | Keep it on Palo Alto (private routes only), or move to a ZTNA tool. dope.security does not provide private access |
| Explicit Proxy | PAC-file based proxy, including agentless SAML or Kerberos options | dope.security agent on managed Mac and Windows devices. Unmanaged devices need a separate plan |
| Remote Networks | IPsec tunnels from branches, licensed per Mbps | Branch firewall or SD-WAN for site traffic. dope.security covers managed laptops at the branch, not headless or IoT devices |
| Service Connections | Links Prisma Access to data centers and HQ | Stays with whatever handles private access |
| Prisma Browser | Secure browser for contractors or unmanaged devices | Separate decision. Keep, replace, or retire |
| Strata Logging Service | Stores Prisma Access logs | dope.console analytics plus SIEM integration. Export anything you must retain before the license ends |
Then export the policy itself: URL categories and their actions, custom URL lists, decryption exclusions, SaaS tenant restrictions, DLP profiles, and the user groups each rule applies to. Note who owns each exception and why it exists. Half of them usually don't need to come with you.
Step 2: Choose your end state
Most teams land on one of two shapes.
Shape A: Move internet security, keep Palo Alto for private access
dope.security takes over web, SaaS, and AI security on every managed laptop. GlobalProtect or the Prisma Agent stays in place, scoped to private routes only. This is the lowest-risk path when you have a lot of internal apps and the ZTNA side works fine. The dope.security agent works alongside GlobalProtect and other VPNs, in full-tunnel or split-tunnel setups, because inspection happens on the device before traffic hits the network.
Prisma Access is licensed in editions (Secure Web Gateway, ZTNA, and Enterprise), so ask your Palo Alto rep what a private-access-only footprint would cost at renewal.
Shape B: Replace both sides
dope.security handles internet, SaaS, and AI. A modern ZTNA tool handles private apps. We wrote up one clean pairing in dope.security x Tailscale: private access rules live in one place, web and data rules in another, and both enforce at the endpoint.
Pick the shape before the pilot. It decides how you configure the VPN client on pilot devices.
Step 3: Map your policy
Translate intent, not syntax. Here's how common Prisma Access controls map:
| Control objective | Typical Prisma Access setup | In dope.security |
|---|---|---|
| URL filtering | Categories with allow, alert, or block | Categories with allow, warn, or block, applied per user or group |
| Custom allow and block lists | Custom URL categories | Custom categories, with path-level matching as well as domains |
| Decryption exclusions | SSL decryption exclusion lists | URL bypass list and application bypass list, plus a default bypass list dope.security maintains |
| SaaS tenant control | Tenant restrictions for SaaS apps | Cloud Application Control: allow enterprise tenants, block personal accounts for ChatGPT, Claude, Google, Microsoft 365, Box, Slack, Salesforce, Dropbox, WebEx, and GitHub |
| Data loss prevention | DLP profiles and data patterns | Dopamine DLP: text is extracted on the device and classified by an LLM with zero data retention, so no regex rules to write |
| Users and groups | Cloud Identity Engine | Imported from Microsoft 365 or Google Workspace and synced every 15 minutes |
| Logging | Strata Logging Service | dope.console analytics and SIEM integration |
Before anything reaches a device, run the Policy Tester. It shows how a URL will be treated for a specific user or group, using the same policy engine as the endpoint. It's the fastest way to catch a mapping mistake without asking someone to reproduce it on their laptop.
Step 4: Run a pilot
A good pilot is small, varied, and measured.
- Pick the group. Choose 25 to 50 people across Mac and Windows, several regions, and at least a few developers. Developers find certificate problems first.
- Deploy through MDM. Push the agent silently with Intune, Jamf, or Kandji. The MDM deployment playbook has the steps.
- Don't double-inspect. For pilot devices, stop sending internet traffic to Prisma Access. Keep private routes on GlobalProtect or the Prisma Agent if you need them. Two inspection layers on the same request means two certificates, two sets of exceptions, and a detour you're trying to remove. The split tunnel vs full tunnel guide covers the routing trade-offs.
- Watch for breakage. dope.security surfaces SSL error notifications when certificate-pinned traffic breaks, so you can add a targeted bypass in a few clicks. More on that in certificate pinning and SSL inspection.
- Measure three numbers before and after. Tickets about slow web or apps that won't load, median page-load time on five common sites, and admin hours spent on exceptions or tunnel upkeep.
Step 5: Roll out in waves
Once the pilot is quiet, expand by department or region. Each wave follows the same pattern: push the agent, confirm policy in the console, then change the VPN client to private-only (Shape A) or remove it (Shape B).
Policy changes reach endpoints in under a minute, so you can fix a wave-one surprise before wave two starts. For scale reference, a Fortune 100 company grew its dope.security deployment from 900 to more than 18,000 devices in weeks, averaging about 3,000 devices per week through Intune. Outreach Health secured 99% of its devices within a week after replacing its legacy SWG.
Step 6: Keep a rollback path until the last wave
Don't tear down Prisma Access the day wave one finishes.
- Leave the Prisma Access configuration intact until every wave is stable. Rolling a group back is a VPN client profile change plus disabling the dope.security agent from the console or removing it through MDM.
- Mind the license clock. Per Palo Alto's documentation, Prisma Access shuts down instances 15 days after the license expires and deletes the instances and tenant 30 days after. Finish your last wave with room to spare before the renewal date.
- Export what you must keep. If compliance requires Prisma Access logs, pull them from Strata Logging Service before access ends.
A suggested six-week plan
This is a planning template, not a customer result. Your timeline depends on how much private access and branch traffic you're moving.
| Week | Goal | Done when |
|---|---|---|
| 1 | Inventory and end-state decision | Component table filled in, Shape A or B chosen |
| 2 | Policy mapping and Policy Tester checks | Top categories, exceptions, and tenant rules verified |
| 3 | Pilot (25 to 50 users) | No open breakage, baseline metrics captured |
| 4 | Wave one | First department live, VPN client changed |
| 5 | Remaining waves | All managed devices on the dope.security agent |
| 6 | Cleanup | Logs exported, rollback no longer needed, renewal scoped down or ended |
What gets simpler afterward
There's no point of presence to choose and no tunnel to babysit for web traffic. Inspection runs on the device, so users go direct and get up to 4x performance compared with legacy proxy SWGs. The agent runs on Mac and Windows in under 100 MB of RAM, and it keeps enforcing cached policy in fallback mode if it can't reach the cloud.
AI governance gets simpler too. Cloud Application Control allows enterprise ChatGPT and Claude and blocks personal accounts. Dopamine DLP catches sensitive data in prompts and uploads. AI Analytics shows which AI apps people use, with personal versus enterprise accounts broken out. If you want the deeper architecture comparison, read Prisma Access vs. an endpoint-native SWG.
Frequently asked questions
Can dope.security replace GlobalProtect?
Not for private access. dope.security replaces the internet, SaaS, and AI security side of Prisma Access. For internal apps, keep GlobalProtect or the Prisma Agent scoped to private routes, or move to a ZTNA tool. The dope.security agent runs alongside both full-tunnel and split-tunnel VPNs.
How long does a Prisma Access migration take?
It depends on scope. Moving only web security for managed laptops is the fast part, since the agent deploys silently through MDM. Branch tunnels, explicit proxy users, and private apps take longer. Our suggested plan runs about six weeks.
Can I run Prisma Access and dope.security at the same time?
Yes, and you should during the pilot and rollout. Just don't inspect the same traffic twice. Route internet traffic for migrated devices away from Prisma Access and keep private routes on the VPN if you need them.
What happens to my Prisma Access tenant when the license expires?
Per Palo Alto's documentation, instances shut down 15 days after license expiration and the instances and tenant are deleted 30 days after. Plan your final wave and log exports before that window.
Do I have to move off GlobalProtect anyway?
Palo Alto positions the Prisma Access Agent, now also called Prisma Agent, as the successor to the GlobalProtect app. Check your own timeline with Palo Alto. If an agent swap is coming either way, it's a natural moment to decide which agent you want on every laptop.
Plan your migration with us
Bring your Prisma Access inventory and we'll map it with you in 20 minutes. Book a 20-minute demo, or start a free trial at dope.security/pricing and run your own pilot this week.
.jpg)
.jpeg)
.jpeg)
