AUS policy enforcement if PCE is unreachable
Note
This functionality is supported with the combination of PCE 26.2.10 and later & VEN 26.2.12 and later.
Beginning in PCE 26.2.10 PCE and 26.2.12 VEN, Adaptive User Segmentation (AUS) maintains policy enforcement even when the PCE is temporarily unreachable.
Previously, the VEN required a live PCE connection to report user status and fetch the needed AUS policy. With these releases, the enforcement layer proactively fetches and caches AUS policy for all configured user groups, so rules are available locally and enforced even if the PCE is unreachable.
This applies to both supported integration types:
Microsoft Entra ID environments, where group and user data is automatically synced to the PCE via the UGM service.
Microsoft Active Directory environments, where groups are manually configured in the PCE.
When the PCE comes back online, AUS policy is refreshed automatically and normal enforcement resumes without dropping existing sessions.
Enable the feature
AUS policy resilience applies at the PCE cluster level and defaults to off. To enable this feature, add the following to the PCE runtime_env.yml, then restart the PCE.
agent_service: aus_resiliency_enabled: true