11-28-2022 11:34 PM
Hi @Barakath ,
Cortex XDR has some really strange authentication and authorization setup...The authentication is done by Customer Support Portal, but as it is mentioned here - Two Factor Authentication for Customer Support Portal - Knowledge Base - Palo Alto Networks MFA is no longer managed under CSP.
The only way user can change his MFA is to login to https://sso.paloaltonetworks.com/enduser/settings
Unfortunately in order to login here user needs to have his password and his MFA, so you have "the egg and the chicken" situation. I don't believe you can reset MFA for another user.
User needs to contact support - https://www.paloaltonetworks.com/company/contact-support and ask them to reset his MFA. They will disable his Okta/Google Auth and enable email MFA. This way user will be able to login to above link and set new Google Auth or Okta
