I am receiving the error message, 'Authenticator enrollment is not allowed at this time. Please contact support for assistance,' when trying to log in to the Support Portal.
Question
Why am I receiving the error message: 'Authenticator enrollment is not allowed at this time. Please contact support for assistance'?
Environment
CSP
OKTA
Answer
When a domain is enabled for third-party SSO, account members with a Standard user role use their company credentials to access our resources. However, account members with the Domain Administrator role will still use Palo Alto credentials to log in.
When a user is assigned the Domain Administrator role in any of the accounts they are a member of, they will need to switch from using their company credentials to using Palo Alto credentials, and a password needs to be created.
The password reset needs to be handled by our Customer Service Team. To open a case for a password reset, visit this link.
Additional Information
How to Enable a Third-Party Identity Provider (IdP)?
Why Domain Admin cannot login to Customer support portal after their user account was created?