Palo Alto Networks Account Setup: The Complete Step-by-Step Guide (2026)

Setting up a Palo Alto Networks account is the first thing you do before you can register your hardware, manage licenses, open support cases, or access firmware updates. Whether you’re a network engineer deploying an NGFW firewall for the first time or an IT admin adding your team to an existing corporate support account, this guide walks you through every step — clearly and without skipping the details that actually matter.

Quick Answer: To set up a Palo Alto Networks account, go to support.paloaltonetworks.com, click “Create my account,” verify your email with an activation code, register your product using a Serial Number or Authorization Code, enter your company information, and complete Multi-Factor Authentication (MFA) setup. New accounts require approval by a Super User if joining an existing organization.

What Is the Palo Alto Networks Customer Support Portal (CSP)?

The Palo Alto Networks Customer Support Portal (CSP) is the central account management platform for all Palo Alto Networks customers and partners. It is hosted at support.paloaltonetworks.com and serves as the hub for:

• Product registration — hardware firewalls, VM-Series, and cloud-based products
• License activation — support contracts, subscriptions, and feature licenses
• Support case management — opening and tracking technical support tickets
• Software downloads — firmware updates, PAN-OS releases, and hotfix files
• Security notifications — alerts for vulnerabilities and exploited configurations
• API key management — for Threat Vault, licensing APIs, and integrations
• User and role management — controlling who in your organization has access to what

Every organization that uses Palo Alto Networks technology should have a properly configured CSP account. Without one, you cannot receive product updates, apply licensed features, or get official technical support.

How to Create Your Palo Alto Networks Account: Step-by-Step

The account creation process begins at support.paloaltonetworks.com. Here is the complete sequence from start to finish.

Step 1: Visit the CSP Registration Page

Go to the Palo Alto Networks Customer Support Portal and click the “Create my account” button on the homepage.

Step 2: Enter Your Email Address

Enter your business email address and complete the CAPTCHA, then click Next. Use a corporate email — personal addresses like Gmail may limit certain account features depending on your organization’s SSO configuration.

Note: Email addresses must start with an alphanumeric character and may only contain alphanumeric characters and special characters such as ! # $ % & ‘ . * + – / = ? ^ _ \ { | } ~`. Dots cannot begin or end the username portion.

Step 3: Verify Your Email with an Activation Code

The CSP sends a time-sensitive Activation Code to your inbox. Enter the code and click Next. Check your spam folder if the email doesn’t arrive within a few minutes — and don’t wait too long before entering it, as the code expires.

Step 4: Register a Product

This step ties your user account to the correct CSP organization using your order information. There are two registration paths:

• Hardware PA-Series firewalls — register using a Serial Number, Authorization Code, Customer ID, or Parent Order Number
• Usage-based VM-Series products — for devices purchased from a public cloud Marketplace or Cloud Security Service Provider (CSSP)

If you are setting up an evaluation account or don’t yet have a product serial number, you can still proceed — but your account may be flagged as Eval status. If you purchased a PAYG license from a Marketplace without any other Palo Alto Networks order, you will need to open a support case to convert your account from Eval to Customer status.

Note: You cannot use a Cortex XDR serial number to self-register on the CSP. Contact Palo Alto Networks Support directly to activate Cortex XDR.

Step 5: Set Up or Join a CSP Account

This is where the path splits depending on your situation.

Creating a brand new CSP account (no existing company account):

Enter your company name and address, then your contact information, and click Next. The CSP will prompt you to:

1. Verify your company address
2. Review and confirm your contact information
3. Complete the CAPTCHA
4. Click Register

Joining an existing CSP account:

If your company already has a CSP account, select “Add me to existing account.” Your request is sent to a Super User on that account. You will receive an email notification once access is granted — this requires the Super User to manually approve your membership request from the Pending Memberships queue.

Step 6: Create Your Password and Configure MFA

Once your account is activated, you will be prompted to create a password and set up Multi-Factor Authentication (MFA). MFA is mandatory for all CSP accounts — full configuration details are in the next section.

How to Register Your Palo Alto Networks Product

Registering your product in the CSP connects your hardware or virtual appliance to your support contract, enabling firmware downloads and technical support access.

For Hardware Products (PA-Series Firewalls)

You will need one of the following:

• Serial Number — found on the physical device label or in the default PAN-OS dashboard
• Authorization Code — from your sales order or partner portal
• Customer ID or Parent Order Number — available from your Palo Alto Networks sales contact

After creating your CSP account, proceed to product registration and provide the serial number or authorization code supplied by your authorized Palo Alto Networks partner.

For VM-Series and Cloud Products

Usage-based VM-Series products can be registered if they were purchased from public cloud Marketplaces (AWS, Azure, GCP) or CSSPs. Cloud marketplace registration is typically handled through the Marketplace provisioning workflow, but a CSP account is still required to access firmware and manage your subscription.

Activating Your License After Registration

Once your product is registered:

1. Log in to the CSP at support.paloaltonetworks.com
2. Navigate to Assets > Devices
3. Confirm your device appears with the correct serial number and support contract status
4. In the PAN-OS web interface, go to Device > License
5. Select “Activate feature using authorization code” and enter your license key

Setting Up Multi-Factor Authentication (MFA) on Your CSP Account

MFA is mandatory on all Palo Alto Networks CSP accounts. Importantly, MFA settings are now configured at sso.paloaltonetworks.com/enduser/settings — this is no longer managed through the CSP My Profile section.

Available MFA Methods

The CSP supports three 2FA methods:

• Email 2FA
• Okta Verify
• Google Authenticator

Option 1: Email 2FA

Email was the legacy default 2FA method. As of September 1, 2024, new users can no longer select email as their MFA method. Existing users who set up email 2FA before that date retain it, but if you remove email as your MFA option, you cannot add it back.

Option 2: Okta Verify (Recommended)

To configure Okta Verify:

1. Click Set up next to Okta Verify in your SSO security settings
2. Select your phone type (iOS or Android)
3. Download the Okta Verify app on your phone
4. Scan the QR code displayed on the setup screen
5. Confirm the setup is working by completing a test login

Note that Okta Verify does not support multi-device authentication — it can only be active on one device at a time.

Option 3: Google Authenticator

To set up Google Authenticator:

1. Open the Google Authenticator app on your phone
2. Scan the QR code displayed on the CSP setup screen
3. Enter the six-digit code from the app to verify the setup

Google Authenticator works offline, making it a strong choice for environments with restricted phone data access.

MFA for FedRAMP (Federal) Accounts

If your account is a FedRAMP federal account, SSO supports different 2FA methods compared to standard accounts. If you are unsure whether your account is FedRAMP-scoped, ask your Domain Administrator.

Resetting MFA

If you need to reset your MFA, you must either have someone with admin access assist you, or log in using your existing credentials and modify your default 2FA method via the Settings section at the SSO portal. If you are fully locked out, click the “Get Help” link on the SSO login screen — this allows you to open a support case without needing to be authenticated.

Understanding User Roles on the Palo Alto Networks Support Portal

The CSP uses a structured user role matrix that controls access and permissions across the portal. Assigning correct roles during initial setup avoids permission gaps and security oversights.

When a user is assigned the Limited Role, they cannot create or manage support cases for any Palo Alto Networks products. To enable case management, assign the user the Standard User role.

The SSO Administrator role is solely responsible for administering third-party Identity Providers and is assigned exclusively by a Super User.

Best Practice: Every CSP account should have at least one member assigned the Emergency Security Contact role. This person receives notifications when security-impacting events are detected — including insecure product configurations, data breaches, and actively exploited vulnerabilities.

How to Manage Users as a Super User

If you hold the Super User role on your organization’s CSP account, you have full control over user management. Here are the most common tasks and how to complete them.

Adding an Existing User to Your Account

1. Log in and select the correct account using the account switcher
2. Go to Members > Manage Users
3. Click Add User to Account
4. Enter the user’s email address
5. Set an expiration date if appropriate
6. Select the necessary roles and click Save

The user must already have their own individual CSP account before you can add them to your organization.

Creating a Brand New User

A Super User can create a new CSP user and add them to the account in one step:

1. Verify you are in the correct account using the account selector
2. Go to Members > Create New User
3. Complete the Create New User form and click Create

The CSP creates a new user account and immediately adds them as a member. An email with login credentials is sent to the new user, and a BCC notification is sent to all Super Users on the account.

Approving Pending Users

When a user self-registers and requests access to your CSP account, they sit in a pending state until a Super User approves them:

1. Navigate to Members > Manage Users
2. If pending users exist, the portal displays: “There is n membership(s) pending review”
3. Click Review Pending Memberships
4. Click Accept or Reject for each pending user

Editing and Removing Users

You can modify a user’s roles, activation date, and expiration date at any time from the Manage Users screen. If you choose Delete User, the user is removed only from your account — they remain active in any other CSP accounts where they hold membership.

Important: A CSP account must always have at least one Super User. If you need to remove the only Super User, you must first promote another user to Super User before completing the deletion.

Exporting Your User List

Click the Export to CSV button in the Manage Users screen to download a full membership report.

In 2026, a new User Change Log tab is available in the CSP User Management section, giving Super Users full transparency into account activity — including who was added, modified, or removed and when.

Setting Up SSO / SAML for Your Organization

Larger organizations typically integrate their Identity Provider (IdP) with the CSP so users can authenticate using their corporate credentials via Microsoft Entra ID, Okta, or Google Workspace — instead of managing separate CSP passwords.

Overview of the SSO Setup Process

1. Log in to the CSP as a Super User
2. Navigate to Account Details > View Single Sign-On (SSO) Settings
3. Complete the Identity Provider information form with your IdP details
4. Save the configuration — Palo Alto Networks Service Provider (SP) information will appear at the bottom of the page
5. Use the SP metadata to update the SAML configuration on your Identity Provider side

Key SAML settings to configure on your IdP:

• Name ID Format: Set to “Unspecified”
• Metadata import: Upload the SP metadata XML from the CSP
• Certificate validation: Optional but recommended for production environments

For Microsoft Entra ID (formerly Azure AD), the official Microsoft Learn portal provides a detailed step-by-step walkthrough for configuring the Palo Alto Networks Admin UI with Entra SSO.

Note: Only a Super User can assign the Domain Admin role, and a user must hold Domain Admin role in order to edit or delete another Domain Admin. Assign your SSO administrator the Domain Admin role before beginning IdP configuration.

Palo Alto Networks Certifications: What You Need to Know

Your CSP account is closely tied to the Palo Alto Networks certification ecosystem. Certification candidates use their Palo Alto Networks login to access the Palo Alto Networks Education portal and schedule exams through Pearson VUE.

The 2025 Certification Program Overhaul

The Palo Alto Networks certification program moved to a role-based model, structured across four levels and three tracks:

Levels: Foundational → Professional → Specialist → Architect

Tracks: Network Security | Security Operations | Cloud Security

Several classic certifications were retired in 2025:

Existing certificate holders retain their certification validity until the individual expiration date printed on their certificate.

Current Certification Tracks (2026)

In 2026, all exams are administered in-person only at Pearson VUE test centers. Most exams are 90 minutes, multiple-choice format, with a passing score of 860 on a 300–1,000 scaled score. Certifications are valid for two years, and earning a higher-level certification in the same track extends active lower-level certifications by two years.

Exam Fees

For the current role-based exam lineup, verify the latest pricing directly on the Pearson VUE Palo Alto Networks exam page, as fees may vary by region and exam level. Legacy exams (PCNSA, PCNSE) were priced at $155–$175 USD before retirement.

Study Resources and Exam Preparation

Palo Alto Networks offers self-paced and instructor-led training through their Education portal, including official exam blueprints and role-based learning paths per track.

For candidates who want to validate readiness before exam day, PassITExams offers practice tests and exam preparation materials for Palo Alto Networks certifications, helping you build confidence and identify knowledge gaps ahead of your scheduled test.

Common Mistakes to Avoid During Palo Alto Networks Account Setup

Getting your CSP account configured correctly from day one saves significant time and frustration. These are the most common pitfalls.

• Using a personal email instead of a business email: The CSP is a corporate platform. A personal Gmail or consumer address can cause issues when your organization’s Super User tries to associate your account — especially if SSO is enforced.
• Not entering the activation code before it expires: The email verification code is time-sensitive. Open it immediately after clicking “Create my account” and complete verification without delay.
• Trying to register a Cortex XDR device via self-registration: Cortex XDR serial numbers cannot be used for CSP self-registration. Contact Palo Alto Networks Support directly to activate Cortex XDR products.
• Skipping MFA setup or relying on email 2FA as a new user: New users can no longer select email as their MFA method. Set up Okta Verify or Google Authenticator immediately via sso.paloaltonetworks.com/enduser/settings to avoid lockout issues later.
• Leaving the account without an Emergency Security Contact: Organizations that skip this role assignment miss critical bulletins about actively exploited vulnerabilities. Always designate at least one Emergency Security Contact during initial user setup.
• Not checking the Pending Memberships queue: Users who self-register and request access to your organization’s CSP account remain in a pending state indefinitely until a Super User acts. Set a reminder to review the Pending Memberships section regularly.
• Assuming a PAYG Marketplace VM is automatically registered: If you purchased a PAYG VM-Series license from a cloud Marketplace without any accompanying PANW hardware order, your account defaults to Eval status. You must open a support case to convert it to a proper Customer account.
• Starting SSO configuration without the Domain Admin role: SSO setup requires a user with Domain Admin role. Attempting to configure IdP integration without it results in incomplete or failed SAML setup.

Comparison: CSP Account Types and Scenarios

Frequently Asked Questions

What is the Palo Alto Networks Customer Support Portal (CSP)?

The CSP is the official account management and support platform for Palo Alto Networks customers, accessible at support.paloaltonetworks.com. It handles product registration, license management, support cases, firmware downloads, and user management for all Palo Alto Networks products.

Is MFA mandatory for the Palo Alto Networks CSP?

Yes. MFA is required for all CSP accounts. New users (registered after September 1, 2024) must use either Okta Verify or Google Authenticator — email is no longer an available option for new account MFA.

How do I reset my MFA if I’m locked out?

If you still have access, log into sso.paloaltonetworks.com/enduser/settings and update your 2FA method in Settings. If fully locked out, click “Get Help” on the SSO login screen before entering credentials to open a support case without authentication.

Can I add a user to my CSP account without them creating their own account first?

Yes. A Super User can create a brand new user and add them to the account simultaneously via Members > Create New User. The new user receives login credentials by email automatically.

What is the difference between Standard User and Limited User roles?

Standard Users can create and manage support cases and manage assets. Limited Users have view-only access and cannot create or manage support cases for any Palo Alto Networks products.

How do I register a PA-Series hardware firewall in the CSP?

Create your CSP account first, then navigate to product registration and enter the serial number from the physical device or the authorization code provided by your authorized Palo Alto Networks partner.

What happened to the PCNSA and PCNSE certifications?

PCNSA was retired January 31, 2025, and PCNSE was retired July 31, 2025. Existing certificate holders retain their certification until its original expiration date. New candidates should pursue the current role-based certifications such as Network Security Professional or NGFW Engineer Specialist.

Can a user be a member of multiple CSP accounts?

Yes. A single user can be a member of multiple CSP accounts simultaneously. When logging in, use the account switcher at the top of the portal to navigate between accounts.

Where exactly do I configure my 2FA settings?

2FA is now managed at sso.paloaltonetworks.com/enduser/settings — it was moved out of the CSP My Profile section. All 2FA enrollment and changes happen on the SSO portal.

Does the Palo Alto Networks CSP offer an API?

Yes. The CSP supports API access for several Palo Alto Networks products including Threat Vault and licensing. Log in to the Support Portal to manage your API keys from the account settings area.

Conclusion

Getting your Palo Alto Networks account configured correctly from the start is the foundation for everything else — activating licenses, downloading firmware, managing your team’s access, and staying informed about critical security advisories. The core steps are straightforward: create your CSP account at support.paloaltonetworks.com, verify your email, register your product using a serial number or authorization code, configure MFA with Okta Verify or Google Authenticator, and assign the right user roles — including at least one Emergency Security Contact.

If you are also working toward a Palo Alto Networks certification, the program overhaul brings a clean role-based structure with Professional and Specialist tracks across Network Security, Security Operations, and Cloud Security. Check the current exam catalog on the Palo Alto Networks certification page and book your exam through Pearson VUE. For practice tests and study materials to help you prepare effectively, PassITExams offers exam preparation resources across multiple IT certification tracks — including cybersecurity and network security.

A properly configured account keeps your security infrastructure fully supported, licensed, and always running on current software.