Authentication failure- If authentication fails, the agent cannot connect using its configured credentials. Common causes include an incorrect client_secret, an expired secret, a redirect URL mismatch, or a sign-in timeout during the OAuth process. Restart the OAuth sign-in process by interacting with the agent again. If the secret is incorrect or expired, generate new credentials from the agent's detail page and update your agent configuration.

"No user found" or identity resolution error during authorization- The user identity in the access token issued by Idira could not be resolved to a user in the CIE-synced directory. Verify that the user attribute mapped in Idira (for example, userPrincipalName) matches the attribute configured in CIE and in the AI Gateway authentication settings. If the user was recently created, wait up to 5 minutes for the CIE sync cycle to complete and retry.

Agent name already taken error on registration- Agent names must be unique within your tenant. Choose a different name and retry the registration.

For support, contact Palo Alto Networks Support following standard PANW support tier response times (P1/P2/P3) per your existing service agreement. No new support model is required for Agent Identity Security.