SAML SSO Admins Cannot Install Software Updates - "You don't have superuser access"

[R.Singh384240]

Hello Everyone,

We are troubleshooting an issue where administrators authenticated through Microsoft Entra ID (Azure AD) SAML SSO are unable to install PAN-OS software updates.

Environment:

• Palo Alto Firewall
• Microsoft Entra ID SAML SSO
• Authentication Profile configured with:
  • Admin Role Attribute: adminrole
• Entra ID SAML Claim:
  • adminrole = customadmin

Behavior:

• SSO authentication works successfully.
• Users can log in to the firewall.
• Local administrator accounts can install software updates without issue.
• SSO administrators receive the following error when attempting to install software:

  "You don't have superuser access"

What we found:

• The SSO users are mapped to a custom Admin Role Profile named customadmin.
• There is another Admin Role Profile on the firewall with CLI Role set to superuser.
• If we modify the Entra ID claim from:

  adminrole = customadmin
  

  to:

  adminrole = superuser
  

  the SSO login fails completely.

Questions:

1. Has anyone successfully mapped Microsoft Entra ID SAML users directly to the built-in superuser role?
2. Does the adminrole SAML attribute require a local Admin Role Profile name rather than a dynamic role value such as superuser?
3. Are software installation operations restricted to local Superuser accounts, or should SAML-authenticated users be able to perform software installations when mapped appropriately?
4. Is there a recommended approach to provide equivalent Superuser privileges to SSO-authenticated administrators?

Any guidance or similar experiences would be greatly appreciated.

Thank you.