New reports On-Demand BPA

manuellara — Mon, 13 Apr 2026 16:00:43 GMT

Hello team:
I have a question: Do you know what the new process will be for generating on-demand BPA reports via the Posture API in Strata Cloud Manager? Given the following message:
“The On-Demand BPA dashboard will be deprecated on April 30, 2026. Please transition to the new Posture API to upload your configurations for an ”on-demand“ best practice report. The new Posture API documentation can be found at”
Best regards.

Re: New reports On-Demand BPA

ZackKNZ — Thu, 30 Apr 2026 16:11:13 GMT

Need to figure this out as well, this has been a standard process for assessing and streamlining our customers for year.

Re: New reports On-Demand BPA

LMcHale — Wed, 27 May 2026 13:56:09 GMT

I reached out to my local channel SE in PAN and this was the response.

Strata Cloud Manager (SCM) BPA Transition Summary

Overview of Changes

As of April 30, 2026, the legacy manual On-Demand BPA upload feature within the Strata Cloud Manager (SCM) and AIOps for NGFW user interface has been deprecated. This change is part of Palo Alto Networks' transition toward real-time, telemetry-driven security posture management.

Recommended Alternative: Zero Trust Posture Center (ZTPC)

The primary replacement for the traditional BPA is the Zero Trust Posture Center. This dashboard provides continuous assessment and real-time best practice verdicts based on active telemetry.

Benefits of ZTPC

Continuous Monitoring: Eliminates the need for manual TSF uploads; security posture is updated automatically as configurations change.
Unified Visibility: View health, compliance, and best practice metrics in a single interface.
Essentials Inclusion: ZTPC is available for both SCM Essentials (free) and SCM Pro license tiers.

How to Enable

To use ZTPC, firewalls must be onboarded to SCM and have Device Telemetry enabled.

Navigate to Device > Setup > Telemetry in the PAN-OS WebUI.
Check Enable Telemetry.
Select the appropriate Region and commit the changes.

Alternative for Air-Gapped Systems: Config Upload API

For environments where telemetry cannot be enabled (e.g., air-gapped or restricted sectors), the manual assessment capability has moved to the BPA Config Upload API.

Key API Details

Endpoint: POST /posture/checks/v1/reports/config-file-upload
Output Format: Reports are returned in JSON format. (The legacy HTML/PDF report format is no longer generated via this method).
Authentication: Requires a Service Account (Client ID and Secret) generated in SCM under System Settings > Identity & Access Management.
Documentation: Full technical specifications are available at pan.dev.

Transition Timeline

July 17, 2023: Standalone BPA tool retired from the Customer Support Portal (CSP).
April 30, 2026: On-Demand BPA UI feature removed from SCM/AIOps.
Present: All best practice assessments should be performed via ZTPC (Telemetry) or the Posture API (Config Upload).

I hope that helps.

topic Re: New reports On-Demand BPA in Strata Cloud Manager

New reports On-Demand BPA

Re: New reports On-Demand BPA

Re: New reports On-Demand BPA

Strata Cloud Manager (SCM) BPA Transition Summary

Overview of Changes

Recommended Alternative: Zero Trust Posture Center (ZTPC)

Benefits of ZTPC

How to Enable

Alternative for Air-Gapped Systems: Config Upload API

Key API Details

Transition Timeline