Integrate SentinelOne with Zero Trust Network Access

In this topic, you will find general instructions on how to integrate the SentinelOne console with Portnox™ Zero Trust Network Access.

Important:
Complete the entire SentinelOne configuration using a device that is enrolled with Portnox and has a Portnox client certificate installed in the browser. SentinelOne requires you to successfully test the configuration before it lets you save it. If you start this configuration in a browser where you cannot run that test later, you will not be able to save your progress, and you will have to start over.

Modify your identity provider configuration to support SentinelOne

SentinelOne SAML integration requires your identity provider to send claims that identify the user and the SentinelOne role to assign to the user. In this task, you will create a new identity provider configuration especially for SentinelOne and add these claims to it.

Important:

  • We strongly recommend that you create a separate identity provider configuration just for SentinelOne, rather than reusing an existing one. However, if only a few users need SentinelOne access, you may not need to do this. Instead, add those users manually in SentinelOne before they sign in with SSO. Manually added users don’t need a role ID in the claims (see below), so in that case reusing an existing configuration may be less work.

  • If you want SentinelOne to create new users automatically (auto-provision), it needs your identity provider to send a role identifier so that it knows which SentinelOne role to assign the user. The simplest approach is to send the same role for every user you want to automatically create in SentinelOne, and then move users into the appropriate SentinelOne role using the SentinelOne console. This guide shows that simple approach as a starting point.

    If you want roles to be assigned automatically based on group/role membership in your identity provider, you can send a different role identifier for each group/role in your identity provider. However, that setup depends on your own environment, so we can’t provide exact steps for it.

  • SentinelOne accepts either a role claim (matches a role by exact, case-sensitive name) or a role_id claim (matches a role by its numeric ID), but never both at the same time. Sending both, or sending a claim with more than one value, causes SentinelOne to reject the login even if the role_id value is correct.

    If you use an existing configuration that already sends a role claim for another application, adding role_id to it breaks SentinelOne login, and reusing that existing role claim instead would require your SentinelOne role names to exactly match the role names expected by the other application. A separate configuration avoids both problems.

  1. In a new tab of your browser, open your SentinelOne console by accessing the following URL: https://your_tenant.sentinelone.net/, where your_tenant is your SentinelOne tenant name. Then, log in with an account that has administrative privileges.

    From now on, we will call this tab the SentinelOne tab.

  2. In the SentinelOne tab, in the left-hand side menu, click on the Policies and settings option, and then in the right-hand side pane, click on the User management > Roles option.

  3. Find the numeric role ID of the SentinelOne role that you want to assign to auto-provisioned users.

    Note down the value in the Role Id column for the role you want to use.

  4. If you use Entra ID, in another browser tab, open Entra ID, and create a new Zero Trust Network Access enterprise application dedicated to SentinelOne, as described in Entra ID IdP configuration. Then, in this new application, do the following steps.
    Note:
    A new application already includes default claims for the user’s email, given name, user principal name, and surname. Leave these as they are; SentinelOne does not use them, and they cause no issues.
    1. Open the Attributes & Claims pane (Single Sign-on > Attributes & Claims > Edit).

    2. Click on the Add new claim button. In the Name field, type Email, and in the Source attribute field, select user.mail. Then, click on the Save button.
      Note:
      In some environments, depending on your Entra ID configuration, you may need to use user.userprincipalname instead of user.mail.
    3. Click on the Add new claim button again. In the Name field, type DisplayName, and in the Source attribute field, select user.displayname. Then, click on the Save button.
    4. Click on the Add new claim button again. In the Name field, type role_id. In the Source attribute field, enter the numeric role ID that you noted down earlier as a constant value. Then, click on the Save button.

    Important:
    If you are adding these claims to an existing identity provider application instead of creating a new one dedicated to SentinelOne, check if a claim named role exists. If it does, remove it. However, this may break an integration with other applications.
  5. If you use Google Workspace, in another browser tab, open your Google Admin Console, and create a new custom SAML app dedicated to SentinelOne. Then, in this new app, do the following steps.
    Note:
    Google Workspace does not support static attributes. To send the same role ID for every user, add a custom field to your user directory and set the same value for every user you want to auto-provision.
    1. In Google Admin Console, go to Directory > Users. Then, click on the More options button, and select the Manage custom attributes option.

    2. Click on the ADD CUSTOM ATTRIBUTE link.

    3. In the Add custom fields pane, enter a Category (for example, SentinelOne) and add one attribute: RoleId. Set Info type to Whole Number, Visibility to Visible to user and admin, and No. of values to Single Value. Then, click on the ADD button.

    4. Go back to the list of users. Then, open each user that needs to be auto-provisioned in SentinelOne, click on the ADD ALTERNATE EMAILS option, scroll down to the category you added, and click on the  ✎  icon to enter the numeric role ID that you noted down earlier.

      Note:
      You can also use different role IDs for different users to assign them different privileges in SentinelOne.
    5. Open the SAML attribute mapping pane (Apps > Web and mobile apps > your Zero Trust Network Access application > Configure SAML attribute mapping.

    6. Click on the ADD MAPPING button and add a mapping for Basic information > Primary email to Email.
    7. Optionally, click on the ADD MAPPING button again and add a mapping for Basic information > Last name to DisplayName.
      Note:
      Google Workspace has no single attribute that holds the user’s full name, only separate First name and Last name fields, and SentinelOne has no way to combine two attributes or take the display name from either First name or Last name directly. If you map Last name as shown here, the SentinelOne console will show just the last name for auto-provisioned users. If you skip this mapping entirely, SentinelOne instead takes the user name from the email address. Administrators can edit the display name manually afterward either way.
    8. Click on the ADD MAPPING button again and add a mapping for SentinelOne > RoleId to role_id.

    9. Click on the Save button.
    Important:
    If you are adding these claims to an existing identity provider application instead of creating a new one dedicated to SentinelOne, check if a claim named role exists. If it does, remove it. However, this may break an integration with other applications.

Create a Portnox Cloud application configuration

In this step, you will create a configuration in Portnox Cloud that will contain all the information necessary to integrate with SentinelOne.

  1. In a new tab of your browser, open your Portnox Cloud account by accessing the following URL: https://cloud.portnox.com/

    From now on, we will call this tab the Portnox tab.

  2. In the Cloud portal top menu, click on the Zero Trust Resources option.

  3. On the Resources screen, click on the Create resource button.

    1. In the What type of resource is this? section, select the SSO web application option.
    2. In the Authentication protocol section, select the SAML option.

    3. Click on the Next button.
  4. Optional: If you have more than one SAML identity provider configured, select the identity provider in the Select an identity provider to use for this resource section.
  5. In the Resource details section, enter a Resource name and optionally a Description.

    In this example, we used the name SentinelOne for the new application configuration but you can use any name you like.

  6. Keep this browser tab open. You will need it later.

Enable SSO access to SentinelOne and set up the domain

In this section, you will access the SentinelOne SSO configuration page and set up the allowed SSO domain.

  1. In the SentinelOne tab, in the User management pane, click on the SSO configuration tab.

  2. Set the SSO switch to Enabled.

  3. Optional: In the SSO Domains section, below the Allowed SSO Domains field, click on the Add Domain button and enter the domain that you want to use for SSO.
    Note:
    Instead, you can activate the Inherit Allowed Domains from Global checkbox, if it’s appropriate for your configuration.

    Important:
    This page can be opened at different scopes: at the account level, or at a specific site level. Check the breadcrumb at the top of the page to confirm which scope you are editing. At the site level, the domain inheritance options differ from the account level, and the Allowed SSO Domains field can show additional domains inherited from the account or global level. Make sure you are configuring the correct scope for your organization before you continue.
  4. In the Identity Provider Settings section, in the Default role field, select the role to assign to a user when no matching role_id is received. We recommend a role with minimal privileges, such as Viewer.

    Warning:
    When we tested the SAML integration and no matching role_id was received, despite a default role being selected in this field, SentinelOne reported an error. Since there is no detailed SAML integration documentation from SentinelOne, based on our tests, we simply recommend that you always provide a correct role ID and disregard this field.

Copy configuration values from the Portnox tab to the SentinelOne tab

In this section, you will copy the values displayed by Portnox Cloud and paste them in the relevant fields in the SentinelOne SSO configuration page.

  1. In the Portnox tab, in the Service details section, click on the  ⧉  icon next to the Sign-In URL / SSO URL field to copy the value.

  2. In the SentinelOne tab, click on the empty field next to the IDP redirect URL label and paste the value copied from Portnox Cloud.

  3. In the Portnox tab, in the Service details section, click on the  ⧉  icon next to the Identity Provider Entity ID / Audience URI field to copy the value.

  4. In the SentinelOne tab, click on the empty field next to the IDP issuerID label and paste the value copied from Portnox Cloud.

  5. In the Portnox tab, in the SAML metadata section, click on the Download metadata XML file link to download the XML file and save it to your local drive.

  6. In the SentinelOne tab, next to the IDP public certificate label, click on the Click to upload or drag & drop button and upload the certificate file downloaded from Portnox Cloud.

  7. Activate the Auto Provisioning checkbox.

    This creates a new SentinelOne user, with the role identified in the role_id claim, the first time each user logs in through SSO.

    Note:
    If you only have a few users who need access, you can leave this checkbox inactive and create those users manually in SentinelOne instead. This way, you don’t need a separate identity provider configuration or a role ID claim at all: since you assign roles manually in SentinelOne, the only claim you need is the user’s email address (to match with the existing user), which you can safely add to an existing configuration.

Copy configuration values from the SentinelOne tab to the Portnox tab

In this section, you will copy the values displayed in the SentinelOne SSO configuration page, and paste them in the relevant fields in Portnox Cloud.

  1. In the SentinelOne tab, click on the  ⧉  icon next to the SP Entity ID field to copy the value.

  2. In the Portnox tab, in the Resource properties section, click on the empty field under the Entity ID / Service Provider Entity URL heading and paste the value copied from SentinelOne.

  3. In the SentinelOne tab, in the Service Provider Settings section, click on the  ⧉  icon next to the Assertion Consumer Service Url field to copy the value.

  4. In the Portnox tab, in the Resource properties section, click on the empty field under the Assertion Consumer Service (ACS) URL / Reply URL heading and paste the value copied from SentinelOne.

Finalize the configuration

In this section, you will finalize the configuration in Portnox Cloud and SentinelOne.

  1. Finalize the configuration in the Portnox tab.
    1. Click on the OPTIONAL SETTINGS link to show additional fields, and then in the Application Login URI field, enter the following value: https://your_tenant.sentinelone.net, where your_tenant is your SentinelOne tenant name.
      Note:
      This step is required if you want to show this application in the ZTNA Secure Access Portal.

    2. Optional: Click on the Next button, and in the Policy enforcement section, in the Device risk assessment section, change the setting to Override with custom policy and then select a risk assessment policy if you want to assess risk with this application using a custom risk assessment policy, and in the Access control section, change the setting to Override with custom policy and then select an access control policy if you want to control access to this application using a custom access control policy.
      Note:
      To configure the access control policy, follow the steps in this topic: Create or edit an access control policy. To select the default access control policy, on the Groups screen, select a group that you want to configure the default for, click on the  ⋮  icon at the end of the row that represents the group, and then select the Group policies option. Then, in the ZTNA Resources section, select the policy in the SSO Web resources drop-down menu.
    3. Scroll all the way down to the end of the page, and then click on the Add resource button.

  2. Finalize the configuration in the SentinelOne tab.
    1. Click on the Test Configuration button to test your configuration.
      Important:
      Clicking this button opens the SAML sign-in dialog immediately, and SentinelOne will not let you save the configuration until this test succeeds. You must perform this test on a computer that is enrolled with Portnox and has a Portnox client certificate installed in the same browser, or the test fails.

      This test only checks that values such as the ACS URL, entity ID, and certificate are correct. It does not check auto-provisioning, such as the existence of the role_id claim, so it can succeed even if role assignment is misconfigured.

    2. Click on the Save button.
    3. Optional: Log in through SSO with a test user using an incognito browser window and confirm, in Policies and settings > User management > Console users, that the user was auto-provisioned with the expected role.

Result: You have configured SentinelOne to be accessible using Portnox Zero Trust Network Access.