Hello Mark, Goodmorning! These are the available options that are available for MAC users to provide their User-ID info to the firewall: 1) Captive Portal (https://live.paloaltonetworks.com/docs/DOC-1159) 2) Install a client that will do AD login 3) Make them connect via SSL VPN and surf through the VPN. 4) User ID API integration using Syslog (https://live.paloaltonetworks.com/docs/DOC-1936) - You would take login events on your OpenDirectory server and syslog these events. Parse through the data and use the API to send this info to the User-ID Agent for ip-mappings. Additionally, user-id agent can also monitor Exchange server, so if the mac users are able to login to Outlook to create login events, we should be able to get the mapping that way as well. Hope that helps! Thanks, Aditi
... View more