Prisma Access egress and public IP addresses can change as a result of autoscaling or infrastructure upgrades, so any allow-list dependent on those addresses (SaaS tenant restrictions, partner firewalls, third-party services) needs a reliable way to stay current. Palo Alto Networks addresses this with two complementary mechanisms. First, an Egress IP Notification URL - the webhook referenced in option A - can be configured under Infrastructure Settings so that Prisma Access sends an HTTP POST a few seconds before a new IP address becomes active, giving downstream automation advance warning to update firewall or SaaS allow-lists before the change takes effect. Second, retrieving the actual address list requires authenticating to the Egress/Public IP retrieval API using an API key that is generated and copied from the service infrastructure settings, as described in option B; this key is passed in the request header when calling the retrieval endpoint. There is no separate " enable the Egress IP API endpoint " toggle, since the retrieval API is available by default once a key is generated - making option C incorrect. Authentication to this API is strictly key-based, not certificate-based, so downloading a client certificate (option D) is not a supported or required step. Together, the webhook and API key form the complete automation loop: notify, then retrieve and apply.
Reference:Prisma Access - Retrieve the IP Addresses for Prisma Access and Get Notifications When Prisma Access IP Addresses Change.

Strata Copilotenhances the capabilities ofPrisma Access security teamsby providingAI-powered insights and recommendationsto help resolve security issues efficiently. It analyzessecurity events, misconfigurations, and alertsand offerscontextual guidancewithrecommended next stepsfor troubleshooting and improving security posture. This assists teams inquickly identifying and addressing security challengeswithout requiring deep manual investigation.

Single sign-on for PAB users accessing public cloud SaaS applications is centrally brokered through the Cloud Identity Engine, which serves as the identity integration point between the organization ' s corporate IdP - Azure AD/Entra ID in this scenario - and the applications and services users access through PAB, rather than being handled by any browser-native or per-application mechanism. Establishing this Cloud Identity Engine-to-IdP integration is what allows the corporate authentication session and identity attributes to be recognized consistently and passed through automatically as the user navigates to sanctioned SaaS applications like Microsoft 365 via PAB, delivering the seamless SSO experience described in the question, which makes option D the essential, correct integration. There is no PAB feature involving direct integration with Microsoft ' s own Conditional Access policy engine as the SSO enablement mechanism (option A); Conditional Access is a Microsoft Entra-native capability that can complement an SSO deployment but is not itself the integration point that establishes SSO through PAB. A " browser-specific SSO extension " (option B) is not the documented architecture for how PAB delivers SSO to cloud applications - SSO is achieved through the identity broker relationship with Cloud Identity Engine, not through a separate extension component layered on top. Manually configuring individual user authentication tokens within the PAB profile (option C) is neither how SSO is designed to function nor a scalable or supported approach; it would defeat the purpose of automated, centrally managed single sign-on entirely.
Reference:Prisma Access Browser - Cloud Identity Engine Integration for SSO to Public Cloud Applications.

Video conferencing tools embedded in a browser depend on two independent technical layers functioning correctly together: the WebRTC protocol, which carries the actual real-time audio/video media stream, and the browser ' s grant of camera and microphone device permissions to the site requesting them. If either layer is restricted, " any video conferencing features across various tools " will fail exactly as described, which is the key to identifying the correct two categories. WebRTC handling is governed under Browser Security Controls - a Prisma Access Browser administrator can explicitly set WebRTC to Block, which is documented as breaking video conferencing tools such as Teams, Zoom, Meet, and WebEx unless their domains are specifically exempted through an exclusion list - making this the first correct category. The second required category is Access & Data Controls, where the Camera and Microphone controls live; these are configured to Allow or Block access to the respective device per matching URL, application, or category, and a Block setting here will prevent any web-based conferencing tool from acquiring the audio/video stream even if WebRTC itself is otherwise permitted. Browser Customization Controls, the second option in the original answer set, govern cosmetic and productivity settings - branding, homepage configuration, and interface appearance - and have no functional relationship to device permissions or media protocol handling, so they cannot explain a video-conferencing failure. Network Security Controls govern network-layer access rather than in-browser device or protocol permissions, and are similarly unrelated to this specific symptom.
Reference:Prisma Access Browser - Browser Security Controls (WebRTC) and Access & Data Controls (Camera, Microphone).

The determining factor in this question is " over the internet, " which separates two internet-transported connectivity methods from a third that is explicitly built to bypass the internet entirely. Service connections are the traditional method: they build an IPSec tunnel from the customer ' s data center edge device across the public internet to Prisma Access, requiring no private circuit or dedicated interconnect. ZTNA Connector achieves the same outcome through a different, more modern architecture - a lightweight, outbound-only connector deployed in the data center that establishes a secure, brokered tunnel to the nearest Prisma Access cloud gateway, again entirely over the internet, without requiring inbound firewall rules or a traditional IPSec peer relationship. Both therefore qualify as internet-transported private application access methods, making A and C correct. Colo-Connect is deliberately excluded because its entire value proposition is the opposite of internet transport: it delivers private, high-bandwidth connectivity to data centers using GCP Dedicated or Partner Interconnects, bypassing the public internet to achieve lower latency, lower jitter, and up to 100 Gbps of throughput - the architecture exists specifically for customers who want to avoid the internet as a transport medium. SD-WAN Connector is not a distinct Prisma Access private-application connectivity component in this context; Prisma SD-WAN integrates through ION devices acting as CPE for remote networks or service connections rather than as its own connector type.
Reference: Prisma Access - Service Connections, ZTNA Connector, and Colo-Connect for Private Application Access.
=========