NewAuthentication Log fields are now available for Panorama. These log fields allow you to view new information such as Region, User Agent and Session ID in your Authentication logs for troubleshooting and to support features in future releases.

Many applications require access to the internet for updates or other services, but in some cases, the Authentication policy may block access. To easily exclude benign background application traffic (such as Windows Update) on user devices from Authentication policy and prevent service interruption, you can use a new external dynamic list (EDL): the Palo Alto Networks Authentication Portal Exclude List. Palo Alto Networks maintains and updates this EDL so that you don't need to manually discover and add all the domains that background applications use to an allow list.

To enforce Authentication policy in environments with large numbers of users, the firewall now uses a multi-threaded process to simultaneously authenticate more users with protocols such as Security Assertion Markup Language (SAML), Kerberos, or the MFA API.