Which feature can help address a customer concern about the length of time it takes to update their SaaS-allowed IP addresses while onboarding to Prisma Access?

The core customer concern is the operational overhead and delay caused by updating SaaS application IP allow-lists. Prisma Access, by default, uses a large, dynamic pool of egress IP addresses, which can change over time. The Dedicated IP addresses feature directly solves this problem by allocating a static, reserved set of egress IP addresses exclusively for the customer's tenant. The customer can provide this small, unchanging list of IPs to their SaaS vendors once, eliminating the need for frequent updates and addressing their concern about the time-consuming nature of the process.

A. Dynamic IP pooling: This is the default behavior that causes the problem described in the question, as the pool of shared IP addresses can change, requiring customers to update their SaaS allow-lists.
B. DNS-based load balancing: This mechanism is used by Prisma Access to direct users to the optimal service connection for performance and availability; it does not control the egress source IP address seen by the destination application.
C. Traffic steering: This is a general term for directing traffic flows. While policy rules are used to steer specific SaaS traffic to use dedicated IPs, the fundamental feature that provides the static IPs and solves the problem is the dedicated IP address allocation itself.

1. Palo Alto Networks - Prisma Access Administrator's Guide: In the section "Provide a Dedicated Egress IP Address for Mobile User Traffic," the documentation states, "To provide a consistent IP address for traffic from your mobile users and remote networks to a specific service or application, you can purchase dedicated egress IP addresses from Palo Alto Networks. This is useful when you have a business partner or a SaaS application that allows access only from a list of allowed IP addresses." This directly aligns with the solution for the scenario.

2. Palo Alto Networks - Prisma Access Administrator's Guide: The section "Egress IP Addresses" explains the default behavior: "By default, Prisma Access uses a pool of IP addresses for egress... Because these IP addresses are part of a pool and can change, Palo Alto Networks recommends that you do not use these IP addresses in security policies or with business partners who allow access based on IP addresses." This confirms that the default dynamic pool is the source of the issue.