Multiple PANOS email alerts stating user authentication failed for various users

 Users receiving multiple alerts from the PANW firewall stating "user failed authentication for user 'xxxx'. User has logged successfully but alert says user account is locked."

•  Any Palo Alto Networks (PANW) firewall
•  Email alerts configured for failed authentication attempts
•  GlobalProtect (GP) using Pre-Logon (Always On) connect method and Single Sign On (SSO)

•  The username entered during host login was different than the username used for GP.
•  Since SSO is configured, the first username entered would fail authentication to the Portal/Gateway as it doesn't match what's configured in the authentication profile.

1. To resolve the issue, Disable SSO while using the Always On connect method if the username differs from what GP expects
2. Note that SSO is enabled by default for Windows hosts beginning in PAN-OS 10.1. Refer to GlobalProtect User Authentication

 GlobalProtect User Authentication