CIE User Context on Firewall is flapping between connected and disconnected status with error "tenantId is empty"
511
Created On 08/13/25 11:08 AM - Last Modified 10/30/25 16:36 PM
Symptom
- User Context for the Cloud Identity Engine provides simplified granular control over the data that is shared across all security devices.
- This can be deployed by following these instructions.
- Once configured and enabled, the connection status is flapping between disconnected and connected.
- System logs (show logs system) report the following error message.
gRPC connection to identity.services-edge.paloaltonetworks.com:443 is broken, error: rpc error: code = Unknown desc = [UploadCUID] [XXXXXXXXXXXX] tenantId is empty
Environment
- Cloud Identity Engine (CIE)
- User Context for User-ID redistribution
- Strata Firewalls
- Supported PAN-OS
Cause
The segment is not added to the enrolled device on the CIE Portal User-context.
Resolution
- Add the segments in the User-Context of CIE Portal.
- Once added, the status is changed to "connected".
- Refer to Cloud Identity Engine User Context for details.