Yes we have enabled "Always-on Policy" as well as "Authenticate users with windows credentials" but the problem is that both works only when user has done first time login to Cato SDP client but the problem is we are now at mercy of enduser wherein in Netskope, there was zero touch experience for users and we did not ask user to authenticate at all. This will help customers to achieve 100% compliance without dependency on end user.
Cato EmployeeHave you looked at pre-login? It works on Windows but not MAC. The client will fire up regardless of them not launching and if they login to their laptop we will pass the creds across the tunnel and the client will then be configured.
Pre-Login
Another approach that I like.....I leverage one of the main SaaS providers for the company. Say, SalesForce. Tell them you want your instance to be accessible from a static CATO IP address. Then setup a Network rule that access to the Application must be NAT'd via CATO IP. Your users that don't login to CATO are then blocked.....they will call the helpdesk and ask "why can I not get to SalesForce?!!?!" Helpdesk then helps the login to CATO to solve the problem and Always-On is enabled.
Pre-Login has already been configured and once user first authenticates then it automatically login the user but my problem is first time authentication to SDP client. I have recently migrated and now agent is pushed on laptop but for the first time, user needs to login to SDP client which users are not doing. In Netskope I did not had this issue as it was auto logged in even for the first time.
Are you authenticating to Cato using SSO? We do, and the client automatically signs in at first boot. No manual action needed.
Yes we are authenticating to Cato using SSO but in our case, user needs to login for the first time to enrol in SDP client.
That's what I suggested to our IT department but they're afraid of users being mad at them.
