https://live.paloaltonetworks.com/t5/prisma-sd-wan-discussions/ion-device-aaa-tacacs-attributes/m-p/1234892#M293 <P>It's not in the docs yet (I will asked to get it amended) but you need to send a custom attribute called "role" with the value either:&nbsp;super, readonly or monitor</P> Tue, 29 Jul 2025 12:58:05 GMT rgallagher 2025-07-29T12:58:05Z https://live.paloaltonetworks.com/t5/prisma-sd-wan-discussions/ion-device-aaa-tacacs-attributes/m-p/1234821#M292 <P>HI,</P> <P>&nbsp;</P> <P>Is there a doco somewhere that describes the tacacs+ attributes required for ION devices. I have the auth working from our ISE implementation but only ever get read-only access to the devices due to missing role attributes but not sure on what specific and the logs dont mention.</P> <P>&nbsp;</P> <P>Cheers,</P> <P>&nbsp;</P> <P>Garrick</P> Tue, 29 Jul 2025 03:24:29 GMT https://live.paloaltonetworks.com/t5/prisma-sd-wan-discussions/ion-device-aaa-tacacs-attributes/m-p/1234821#M292 DunkleyG 2025-07-29T03:24:29Z https://live.paloaltonetworks.com/t5/prisma-sd-wan-discussions/ion-device-aaa-tacacs-attributes/m-p/1234892#M293 <P>It's not in the docs yet (I will asked to get it amended) but you need to send a custom attribute called "role" with the value either:&nbsp;super, readonly or monitor</P> Tue, 29 Jul 2025 12:58:05 GMT https://live.paloaltonetworks.com/t5/prisma-sd-wan-discussions/ion-device-aaa-tacacs-attributes/m-p/1234892#M293 rgallagher 2025-07-29T12:58:05Z