SAML SSO Admins Cannot Install Software Updates - "You don't have superuser access"

R.Singh384240 — Wed, 05 Aug 2026 16:37:58 GMT

Hello Everyone,

We are troubleshooting an issue where administrators authenticated through Microsoft Entra ID (Azure AD) SAML SSO are unable to install PAN-OS software updates.

Environment:

Palo Alto Firewall
Microsoft Entra ID SAML SSO
Authentication Profile configured with:
- Admin Role Attribute: adminrole
Entra ID SAML Claim:
- adminrole = customadmin

Behavior:

SSO authentication works successfully.
Users can log in to the firewall.
Local administrator accounts can install software updates without issue.
SSO administrators receive the following error when attempting to install software:

"You don't have superuser access"

What we found:

The SSO users are mapped to a custom Admin Role Profile named customadmin.
There is another Admin Role Profile on the firewall with CLI Role set to superuser.
If we modify the Entra ID claim from:
```
adminrole = customadmin
```
to:
```
adminrole = superuser
```
the SSO login fails completely.

Questions:

Has anyone successfully mapped Microsoft Entra ID SAML users directly to the built-in superuser role?
Does the adminrole SAML attribute require a local Admin Role Profile name rather than a dynamic role value such as superuser?
Are software installation operations restricted to local Superuser accounts, or should SAML-authenticated users be able to perform software installations when mapped appropriately?
Is there a recommended approach to provide equivalent Superuser privileges to SSO-authenticated administrators?

Any guidance or similar experiences would be greatly appreciated.

Thank you.

Re: SAML SSO Admins Cannot Install Software Updates - "You don't have superuser access"

JayGolf — Thu, 06 Aug 2026 03:51:03 GMT

Hi @R.Singh384240 ,

I've seen it mapped with Okta. What does the SAML assertion show for the adminrole attribute when the login fails? I would confirm that Entra is sending the attribute name exactly as configured in the Auth Profile and the value exactly "superuser"

What do authd.log and system logs show?

topic SAML SSO Admins Cannot Install Software Updates - "You don't have superuser access" in General Topics

SAML SSO Admins Cannot Install Software Updates - "You don't have superuser access"

Re: SAML SSO Admins Cannot Install Software Updates - "You don't have superuser access"