The Panorama® management server fails to push a data profile (ObjectDLPData Filtering Profile) to NGFW when the data profile is exclusively attached to an AI Security profile and that AI Security profile (ObjectsSecurity ProfilesAI Security) is not referenced by any Security profile. Enterprise DLP inspection does not apply to traffic that matches AI security policies.

Workaround: Attach the data profile to at least one Security profile in addition to the AI Security profile. This ensures Panorama can successfully push the data profile to managed NGFW.

Enterprise Data Loss Prevention (E-DLP) tenant provisioning for Panorama-managed deployments fail due to certificate validation checks for Enterprise DLP do not complete successfully. This causes Enterprise DLP profile operations that depend on certificate chain verification to fail.

The Panorama® management server allows you to delete an application filter (ObjectsApplication Filters) currently referenced by a data profile (ObjectDLPData Filtering Profile) and doesn't provide a warning or error. After deletion, the data profile retains a reference to the deleted object, which can cause unexpected behavior when the data profile is evaluated.

On the Panorama® management server, the menu node for data filtering profiles (ObjectsDLPData Filtering Profiles also displays under Security Profiles (ObjectsSecurity Profiles).

On the Panorama® management server, data filtering profiles (ObjectsDLPData Filtering Profiles) fail to open and display the following error:

On the Panorama management server, you cannot create an admin role (PanoramaAdmin Roles) to control access to Enterprise Data Loss Prevention (DLP) filtering settings and snippet configuration (DeviceSetupDLP).

Enterprise Data Loss Prevention (DLP) data profile Thread ID/Name filter is not available when you configure a custom report (ManageManage Custom Reports) on the Panorama management server or locally on a firewall leveraging Enterprise DLP.

On the Panorama management server, custom data profiles (ObjectsDLPData Filtering Profiles) are not synchronized to the DLP cloud service if you have an active CASB-X license. This prevents you being able to associate the data profile with a Security policy rule and displays the error Data Profile does not exist.

Workaround: Contact Palo Alto Networks Support to restore synchronization functionality between the DLP cloud service and Panorama.