topic Re: MFA on the Palo Support Portal? in General Topics

MFA on the Palo Support Portal?

jsalmans — Thu, 14 Apr 2022 15:44:33 GMT

I saw the announcement that they were going to start requiring MFA for logging in on the Palo Alto websites and it mentions a code via email, however, I was already set up to use an authenticator app for this. When I went to log in today, it seems to be ignoring my account settings and doing the email code every time. I tried switching to the email method, saving, and then changing back to the authenticator option and saving again but it still seems to only give me the option to email a code at login.

Is anyone else running into this too?

Re: MFA on the Palo Support Portal?

LAYER_8 — Thu, 14 Apr 2022 19:50:02 GMT

Internally I've had to reset my preferences 2 different times. Before you login, where you type your email, click the blue "get help" button to open a case, have them reset your preferences, and try it that way. Sometimes the frontend doesn't talk so good to the backend.

Re: MFA on the Palo Support Portal?

jsalmans — Thu, 14 Apr 2022 20:24:21 GMT

Ok thanks.. we may have to do that. I just went in there again and I was able to re-enroll in the Google Authenticator method successfully but the login process still seems to be ignoring it and going to the email code.

Re: MFA on the Palo Support Portal?

hpatel11 — Fri, 15 Apr 2022 13:53:10 GMT

@jsalmans were you able to re-enroll? for me it's not even show options to re-enroll. Get it going with email for now waiting to hear back from support.

Re: MFA on the Palo Support Portal?

hpatel11 — Wed, 01 Jun 2022 14:59:23 GMT

This is what I got from palo support.

Users may be asked to change their passwords in order to meet the new password policies.
MFA will be enforced for all customers, irrespective of the product or the application they are trying to access

Why am I being prompted for MFA?
MFA is enforced for all customers and partners irrespective of what application or product is accessed

What are the MFA factors that are currently supported with this change?
Only Email is supported and more MFA factors will be added in the future (Eg: Google Authenticator)

I currently use Google Authenticator as an MFA factor. Will it continue to work?
Unfortunately, No. Once we support the Google Authenticator on Okta, it will have to re-registered since there is no way to port over the data

Can a customer account be exempted from MFA?
No, this is no longer an option. A valid business justification will be required for an exemption, which will then be reviewed with the Information Security team to assess the risk of doing so.

Why am I being prompted for password change?
Customers are prompted to change if their current password does not comply with new password standards

How often do I need to change my password?
Every 365 days from the last time the password has been changed

Re: MFA on the Palo Support Portal?

DPoppleton — Wed, 01 Jun 2022 14:58:02 GMT

Anyone else having a hard time using the email authenticator? It took several tries to get an email before the session timed out.

Re: MFA on the Palo Support Portal?

hpatel11 — Wed, 01 Jun 2022 15:01:25 GMT

yup had some issue in beginning but then we whitelisted that email to bypass email gateway.

Re: MFA on the Palo Support Portal?

SeanDeHarris — Wed, 08 Jun 2022 07:22:48 GMT

The email of OTP for 2FA always delayed for me. 😑😑😑

Re: MFA on the Palo Support Portal?

jsalmans — Fri, 10 Jun 2022 14:44:18 GMT

Is it just me or is the MFA options completely gone now? It's using the "email a code" method still but I figured by now they'd have re-implemented the option to use an Authenticator. I looked the other day and I don't see anything MFA related at all anymore in the user sections.

Re: MFA on the Palo Support Portal?

SeanDeHarris — Mon, 13 Jun 2022 01:42:09 GMT

Just found out last week, the other 2FA options have been moved to other places

If your account is FedRAMP (federal), single sign-on (SSO) supports the following 2FA methods:

Email
Okta Verify

If your account is not FedRAMP, SSO supports the following 2FA methods:

Email
Okta Verify
Google Authenticator

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClN9CAK

Re: MFA on the Palo Support Portal?

hpatel11 — Mon, 13 Jun 2022 12:02:45 GMT

Thanks! that worked for me.

Re: MFA on the Palo Support Portal?

jsalmans — Mon, 13 Jun 2022 21:44:44 GMT

Thanks! Do you know if you can still control it for other users in your org? I'd like to make the Google MFA option required for everyone on our portal like we used to have.

Re: MFA on the Palo Support Portal?

SeanDeHarris — Tue, 14 Jun 2022 02:37:03 GMT

Possibly cannot.

The only way to change the default 2FA method to others is login to the following website which required individual user credential. It seems it's a per-user options.
https://sso.paloaltonetworks.com/enduser/settings

Re: MFA on the Palo Support Portal?

AnzeZvanut — Wed, 15 Jun 2022 08:43:54 GMT

Hi.

Since Palo Alto requires MFA for Support portal I am getting more and more frustrated, I am using Support portal, KB and everything everyday all the time. I have to authenticate all the time, this doesn't help me.

How can we improve user experince with all these security improvments?