“Authorization failed for user admin via Web from 127.0.0.1: Invalid user.” is seen in the system log of PA-VM on Azure

“Authorization failed for user admin via Web from 127.0.0.1: Invalid user.” is seen in the system log of PA-VM on Azure

1610
Created On 12/17/25 02:37 AM - Last Modified 02/24/26 21:29 PM


Symptom


After the upgrade to PAN-OS 11.1.11, The firewall generates the Authorization failed system logs every 5 seconds.

system logs



Environment


  • Azure PA-VM NGFW Firewall
  • VM-Series plugin version 5.1.9 (which is packaged with PAN-OS 11.1.11)
  • Deleted default admin user from the configurations.


Cause


  • The authorization request originates from the VM-Series plugin’s health monitoring system.
  • Starting from the VM-Series plugin version 5.1.9, the plugin health-monitoring functionality uses the user 'admin' to check Panorama connectivity status.
  • As per the plugin’s design, the user 'admin' is expected to always be present.
  • If the user 'admin' is deleted, this functionality will not work as expected. As a result, the authentication error appears for every plugin API request


Resolution


  1. Create a custom role with all permissions disabled.
  2. Create the user 'admin' again.
  3. Assign the custom role in to the user 'admin'.
  4. Commit.


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA1Ki000000wkAXKAY&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail