Mobile Users - Global Protect greyed out on the Panorama for a working mobile user setup.

• The Panorama is managing Prisma Access and it is an existing working setup.
• The Mobile Users - Global Protect tab under cloud service is greyed out and the admin cannot make any changes now.
• The licenses for Prisma Access has recently been renewed and are updated on the panorama.
• There are no errors on the cloud service plugin or Panorama related to this problem.
• The Mobile user template still has the GlobalProtect portal and gateway configuration.

• Prisma Access managed by panorama.

• This is caused due to the license renewal not being reflected on the Prisma Access backend.
• Validate the license details with steps below.
• Check the license expiration dates on the panorama > Licenses. This will show correct future dates.

request license fetch

License entry:
Feature: GBL-MU-ENT
Description: Cloud Service
Serial: 000xxxxxxxx
Authcode:
Issued: June 17, 2023
Expires: June 18, 2026. << Future date
Expired?: no
Serial: xxxxxxxxxx
User Limit: xxxx

• Run following commands to view the license dates in the Prisma Access backend.

debug plugins cloud_services prisma-access license-capabilities fetch

debug plugins cloud_services prisma-access license-capabilities show

pass
"PAN-PRISMA-ACCESS-PREM-SUCCESS", "authcode": "xxxxxxx", "category": "PAID", "license_expiration": "2023-06-16T22:42:37", 

• The licenses on Prisma Access backend shows expiring on June 16 (the output was taken on June 29).
• This shows an issue with the sync of licenses between Prisma Access and actual licenses observed on support portal.

1. Reach out to Palo Alto support team with above data. 
2. The support team would help get the licenses updated. 
3. Once done, Run following commands to fix the issue.

debug plugins cloud_services prisma-access license-capabilities fetch
debug plugins cloud_services prisma-access license-capabilities show // To validate the correct expiry date