Panorama Admin login fails with error "SAML Single-sign-on failed" when using Azure AD SAML Single Sign-on (SSO)

• Panorama GUI login fails to work with Azure-based Single Sign-on.
• After entering the user and password in the Panorama login page, error message "SAML single-sign-on failed" is seen. 

• "Authentication failed for user" messages are seen under the Monitor tab for Panorama when using other working user. 

• Panorama
• PAN-OS 10.0.4
• Azure AD SSO (Azure Active Directory Single Sign-on)

1. In Azure AD, at the following path, Home > Palo Alto Networks - Admin UI > (User), check the "User type" of the user. 

In the below example, it's set as "Member":

2. Confirm that under Home > Palo Alto Networks - Admin UI > Single sign-on > User Attributes &  Claims, we have created a new "User Attribute" called "adminrole":

3. Click on the Edit button for User Attributes & Claims and confirm that the User type for adminrole, matches the user type found in step # 1. They have to match.

• Tutorial: Azure Active Directory integration with Palo Alto Networks - Admin UI
• Configure SAML Authentication for Panorama Administrators