“Authorization failed for user admin via Web from 127.0.0.1: Invalid user.” is seen in the system log of PA-VM on Azure
1610
Created On 12/17/25 02:37 AM - Last Modified 02/24/26 21:29 PM
Symptom
After the upgrade to PAN-OS 11.1.11, The firewall generates the Authorization failed system logs every 5 seconds.
Environment
- Azure PA-VM NGFW Firewall
- VM-Series plugin version 5.1.9 (which is packaged with PAN-OS 11.1.11)
- Deleted default admin user from the configurations.
Cause
- The authorization request originates from the VM-Series plugin’s health monitoring system.
- Starting from the VM-Series plugin version 5.1.9, the plugin health-monitoring functionality uses the user 'admin' to check Panorama connectivity status.
- As per the plugin’s design, the user 'admin' is expected to always be present.
- If the user 'admin' is deleted, this functionality will not work as expected. As a result, the authentication error appears for every plugin API request
Resolution
- Create a custom role with all permissions disabled.
- Create the user 'admin' again.
- Assign the custom role in to the user 'admin'.
- Commit.