When the Prisma Access Agent is disabled, the generated event log does not include the Source User field. This field appears as missing, null, or "Unknown" in the event log details.

On endpoints running macOS, if the Prisma Access Agent is installed manually without a mobile device management (MDM) profile, and users do not allow the endpoint security extension and grant Full Disk Access for the enforcer, the com.paloaltonetworks.pangdlp.enforcer process continues to restart. This behavior can result in a loss of data loss prevention (DLP) coverage on the endpoint.

On Windows endpoints running Prisma Access Agent version 26.2.2, the Prisma Access Agent app does not display the Server name and Connect button when the agent is enrolled but has not yet completed authentication.

When uninstalling the Prisma Access Agent on endpoints running macOS using the command-line interface (CLI) uninstaller (sudo uninstaller), if Anti-Tamper protection is enabled and you enter the Anti-Tamper uninstall password at the prompt for the local administrator password, the uninstallation does not complete successfully. This leaves the agent in a partially uninstalled and corrupted state where some components, such as pacli, are removed, but others, such as paaui, remain, leaving the endpoint unprotected and unmanageable.