A company plans to deploy identity for improved visibility and identity-based controls for least privilege access to applications and dat a. The company does not have an on-premises Active Directory (AD) deployment, and devices are connected and managed by using a combination of Entra ID and Jamf. Which two supported sources for identity are appropriate for this environment? (Choose two.)

The company's environment is cloud-native, using Entra ID (formerly Azure AD) and Jamf, with no on-premises Active Directory. The Cloud Identity Engine (CIE) is the ideal solution as it is designed to synchronize user and group information directly from cloud identity providers like Entra ID. This provides a seamless, agentless method for user identification. GlobalProtect is also appropriate as it can identify users connecting to the network and collect Host Information Profile (HIP) data for device posture, integrating with cloud identity providers for authentication. This combination provides comprehensive user and device visibility.

A. Captive portal is a valid identity source but is less seamless for managed devices and does not leverage the existing Entra ID infrastructure as effectively as CIE.
B. User-ID agents using WMI probing are specifically for on-premises Windows Active Directory environments, which the company does not have.

1. Palo Alto Networks. (2023). Cloud Identity Engine Administrator's Guide. "Integrate the Cloud Identity Engine with Your Directory." This section details how CIE integrates with Azure AD (Entra ID) to retrieve user and group information.

2. Palo Alto Networks. (2024). GlobalProtect Administrator's Guide. "Set Up User-ID from GlobalProtect." This guide explains how GlobalProtect can be configured to act as a source for User-ID information.

3. Palo Alto Networks. (2024). User-ID Administrator's Guide. "Map IP Addresses to Users." This document clarifies that WMI probing is a method for Windows environments, which is not applicable here.