I am receiving the error message, 'Authenticator enrollment is not allowed at this time. Please contact support for assistance,' when trying to log in to the Support Portal.
Question
Why am I receiving the error message: 'Authenticator enrollment is not allowed at this time. Please contact support for assistance'?
Environment
CSP
OKTA
Answer
When a domain is enabled for third-party SSO, account members with a Standard user role use their company credentials to access our resources. However, account members with the SSO Administrator role will still use Palo Alto credentials to log in.
When a user is assigned the SSO Administrator role in any of the accounts they are a member of, they will need to switch from using their company credentials to using Palo Alto credentials, and a password needs to be created.
For assistance with a password reset, please open a case by visiting this link.
Additional Information
How to Enable a Third-Party Identity Provider (IdP)?
Why SSO Admin cannot login to Customer support portal after their user account was created?