MFA on the Palo Support Portal?

[jsalmans]

I saw the announcement that they were going to start requiring MFA for logging in on the Palo Alto websites and it mentions a code via email, however, I was already set up to use an authenticator app for this.  When I went to log in today, it seems to be ignoring my account settings and doing the email code every time.  I tried switching to the email method, saving, and then changing back to the authenticator option and saving again but it still seems to only give me the option to email a code at login.

Is anyone else running into this too?

[LAYER_8]

Internally I've had to reset my preferences 2 different times. Before you login, where you type your email, click the blue "get help" button to open a case, have them reset your preferences, and try it that way. Sometimes the frontend doesn't talk so good to the backend. 

[jsalmans]

Ok thanks.. we may have to do that.  I just went in there again and I was able to re-enroll in the Google Authenticator method successfully but the login process still seems to be ignoring it and going to the email code.

[hpatel11]

@jsalmans were you able to re-enroll? for me it's not even show options to re-enroll. Get it going with email for now waiting to hear back from support. 

[hpatel11]

This is what I got from palo support. 

Users may be asked to change their passwords in order to meet the new password policies.
MFA will be enforced for all customers, irrespective of the product or the application they are trying to access


Why am I being prompted for MFA?
MFA is enforced for all customers and partners irrespective of what application or product is accessed

What are the MFA factors that are currently supported with this change?
Only Email is supported and more MFA factors will be added in the future (Eg: Google Authenticator)

I currently use Google Authenticator as an MFA factor. Will it continue to work?
Unfortunately, No. Once we support the Google Authenticator on Okta, it will have to re-registered since there is no way to port over the data

Can a customer account be exempted from MFA?
No, this is no longer an option. A valid business justification will be required for an exemption, which will then be reviewed with the Information Security team to assess the risk of doing so.

Why am I being prompted for password change?
Customers are prompted to change if their current password does not comply with new password standards

How often do I need to change my password?
Every 365 days from the last time the password has been changed

[DPoppleton]

Anyone else having a hard time using the email authenticator? It took several tries to get an email before the session timed out.

[hpatel11]

yup had some issue in beginning but then we whitelisted that email to bypass email gateway.

[SeanDeHarris]

The email of OTP for 2FA always delayed for me.  😑😑😑

[jsalmans]

Is it just me or is the MFA options completely gone now?  It's using the "email a code" method still but I figured by now they'd have re-implemented the option to use an Authenticator.  I looked the other day and I don't see anything MFA related at all anymore in the user sections.

[SeanDeHarris]

Just found out last week, the other 2FA options have been moved to other places

If your account is FedRAMP (federal), single sign-on (SSO) supports the following 2FA methods:

• Email
• Okta Verify

If your account is not FedRAMP, SSO supports the following 2FA methods:

• Email
• Okta Verify
• Google Authenticator

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClN9CAK

[hpatel11]

Thanks! that worked for me. 

[jsalmans]

Thanks!  Do you know if you can still control it for other users in your org?  I'd like to make the Google MFA option required for everyone on our portal like we used to have.

[SeanDeHarris · Accepted solution]

Possibly cannot.

The only way to change the default 2FA method to others is login to the following website which required individual user credential.  It seems it's a per-user options.
https://sso.paloaltonetworks.com/enduser/settings

[AnzeZvanut]

Hi.

Since Palo Alto requires MFA for Support portal I am getting more and more frustrated, I am using Support portal, KB and everything everyday all the time. I have to authenticate all the time, this doesn't help me.

How can we improve user experince with all these security improvments?

KR