2.2 User-ID Architecture, Identity Mapping & Group Enforcement

Key Takeaways

User-ID binds dynamic IP addresses to authoritative enterprise identities, allowing security policies and threat analytics to enforce access controls based on Active Directory users and group memberships.
The Integrated Agentless User-ID engine queries Domain Controllers directly using WinRM (ports 5985/5986) or WMI, while the Windows-based User-ID Agent offloads log processing across complex, multi-site enterprise environments via TCP port 5007.
Security event log parsing relies on Windows Event ID 4624 (successful logon) and Kerberos TGT/TGS events (Event IDs 4768 and 4769) to maintain timely, highly accurate IP-to-user cache entries.
The Terminal Services (TS) Agent resolves user attribution in multi-user environments (Citrix XenApp, Microsoft RDS) by allocating distinct, sequential source port blocks per concurrent user session.
Dynamic User Groups (DUGs) evaluate real-time metadata security tags applied through automated log actions or REST APIs, adjusting user security policies dynamically without requiring a configuration commit or directory modifications.

Last updated: September 2026

2.2 User-ID Architecture, Identity Mapping & Group Enforcement

Quick Answer: The PAN-OS User-ID technology transforms enterprise network security by binding dynamic IP addresses to verified user identities and directory group memberships. Instead of writing static policies tied to ephemeral IP addresses, administrators author security rules referencing Active Directory or cloud identities (e.g., Finance-Team or Engineering-Admins). User-ID achieves this through multiple ingestion mechanisms, including Active Directory event log scraping (Event IDs 4624, 4768, 4769) using agentless WinRM/WMI or the Windows-based User-ID Agent, Syslog listeners for 802.1X NAC, GlobalProtect authentication, and the Cloud Identity Engine (CIE). In multi-user Citrix or RDS environments, the Terminal Services Agent allocates dedicated source port blocks per user, while Dynamic User Groups (DUGs) enable real-time quarantine and adaptive policy enforcement without configuration commits.

User-ID Mapping Architecture & Mechanisms

In modern enterprise networks, IP addresses are dynamic, temporary network identifiers. Dynamic Host Configuration Protocol (DHCP) leases, virtual desktop infrastructure (VDI), wireless roaming, and remote work constantly rotate client IP assignments. Writing firewall rules based solely on IP addresses requires continuous operational overhead and results in either overly permissive rules or broken access.

User-ID decouples network identity from physical addressing by maintaining an internal IP-to-User mapping table within the firewall dataplane. When a client initiates a session, PAN-OS extracts the source IP address, cross-references the IP-to-User cache, associates the flow with the user's canonical username (e.g., corp\jsmith), and queries cached directory groups (e.g., CN=Financial-Analysts,OU=Groups,DC=corp,DC=local) to execute policy matching.

   ┌────────────────────────────────────────────────────────┐
   │                User-ID Ingestion Sources               │
   └───────────────────────────┬────────────────────────────┘
                               │
       ┌───────────────────────┼───────────────────────┐
       ▼                       ▼                       ▼
┌──────────────┐       ┌──────────────┐       ┌────────────────┐
│ Active Dir.  │       │ Syslog NAC   │       │ GlobalProtect  │
│ Logs (4624)  │       │ (ISE/Aruba)  │       │ Gateways / CIE │
└──────┬───────┘       └──────┬───────┘       └────────┬───────┘
       │                       │                       │
       └───────────────────────┼───────────────────────┘
                               ▼
               ┌───────────────────────────────┐
               │    PAN-OS IP-to-User Cache    │
               │  10.1.1.50 <-> corp\jsmith    │
               └───────────────┬───────────────┘
                               │
                               ▼
               ┌───────────────────────────────┐
               │    Directory Group Mapping    │
               │  corp\jsmith in Finance-Admins│
               └───────────────┬───────────────┘
                               │
                               ▼
               ┌───────────────────────────────┐
               │   Security Policy Match       │
               │ Rule: 'Allow-Finance-To-SAP'  │
               └───────────────────────────────┘

User-ID Mapping Ingestion Sources

PAN-OS aggregates IP-to-user mappings through diverse authoritative sources:

Active Directory Event Log Scraping: Interrogating Domain Controllers for successful user authentications.
Syslog Listening: Ingesting real-time authentication syslog notifications from network access control (NAC) systems (Cisco ISE, Aruba ClearPass), wireless LAN controllers (WLCs), and VPN concentrators.
GlobalProtect: Remote users authenticating to GlobalProtect portals and gateways automatically generate authoritative mappings that bind the assigned virtual tunnel IP to the user's credentials.
Captive Portal: Firewalls challenge unmapped web traffic with transparent Kerberos/NTLM authentication or interactive SAML/web-form logins.
PAN-OS XML API: External identity providers, PAM systems, and orchestration platforms push IP-to-user mappings directly into the firewall via REST/XML API calls.
Cloud Identity Engine (CIE): Cloud-native synchronization connecting identity providers (Microsoft Entra ID, Okta, Google Workspace) to firewalls.

Each mapping entry maintains a configurable timeout timer (typically 45 minutes to 8 hours). When an event occurs (e.g., workstation re-authentication), the timer refreshes. If the timeout expires without renewal, the mapping purges from memory to prevent identity misattribution.

Windows-Based User-ID Agent vs. Integrated Agentless Engine

When collecting logon events from Active Directory Domain Controllers, administrators choose between the Integrated Agentless Engine and the external Windows-based User-ID Agent.

Architectural Attribute	Integrated Agentless User-ID	Windows-based User-ID Agent
Software Footprint	None. Runs directly on the PAN-OS management plane.	Requires dedicated Windows Server virtual machines domain-joined to Active Directory.
Communication Protocol	WinRM (Windows Remote Management via HTTP 5985 / HTTPS 5986) or WMI (RPC/DCOM).	Local Windows API calls to DCs; communicates to PAN-OS via XML API over TCP port 5007.
Domain Scalability	Ideal for small to mid-size networks (typically up to 10–50 Domain Controllers depending on hardware model).	Engineered for massive enterprise environments (aggregates events from hundreds of DCs across multiple untrusted forests).
Network Bandwidth Impact	Every firewall individually queries and pulls event logs across the network from every configured DC.	The agent queries DCs locally, filters irrelevant event IDs, deduplicates entries, and streams a single consolidated feed to firewalls.
High Availability & Clustering	Configured independently per firewall or managed through Panorama templates.	Supports active/passive agent deployments with automatic failover.

Transport Protocol Considerations: WinRM vs. WMI

Historically, the agentless engine relied on Windows Management Instrumentation (WMI). WMI uses Microsoft RPC (TCP port 135) and negotiates dynamic ephemeral high ports (TCP 49152–65535). This legacy approach required opening wide firewall port ranges and placed significant CPU load on Domain Controllers.

PAN-OS best practice strongly mandates configuring WinRM over HTTPS (TCP port 5986) or WinRM over HTTP (TCP port 5985). WinRM uses standard HTTP-based transport protocols, optimizes event subscription queries, reduces DC CPU overhead by up to 80%, and requires only a single static port through intermediate perimeter firewalls.

Active Directory Security Event Log Parsing Mechanics

The User-ID engine parses specific Windows Security Event IDs generated by Domain Controllers and Microsoft Exchange servers to track logon, ticket generation, and logoff actions.

┌────────────────────────────────────────────────────────────────────────┐
│                     Monitored Windows Security Events                  │
├──────────────┬─────────────────────────────────────────────────────────┤
│ Event ID     │ Description & Parsing Role                              │
├──────────────┼─────────────────────────────────────────────────────────┤
│ **4624**     │ **Successful Account Logon:** Primary source of mapping.│
│              │ Captures username, domain, and client workstation IP.   │
│              │ Evaluates Logon Types:                                  │
│              │   • Type 2: Interactive (Direct console/keyboard)       │
│              │   • Type 3: Network (File share, mapped drive, SSO)     │
│              │   • Type 10: RemoteInteractive (RDP / Terminal Services)│
├──────────────┼─────────────────────────────────────────────────────────┤
│ **4768**     │ **Kerberos TGT (Ticket-Granting Ticket) Request:**       │
│              │ Emitted when a user authenticates to the Key            │
│              │ Distribution Center (KDC). Contains User and Client IP. │
├──────────────┼─────────────────────────────────────────────────────────┤
│ **4769**     │ **Kerberos TGS (Ticket-Granting Service) Request:**       │
│              │ Emitted when a user accesses a network service (e.g.    │
│              │ SharePoint, SQL). Validates active network presence.    │
├──────────────┼─────────────────────────────────────────────────────────┤
│ **4634/4647**│ **User Logoff / Explicit Disconnect:**                 │
│              │ Indicates session termination. Can trigger mapping      │
│              │ removal from active cache if aggressive unmap is used.  │
└──────────────┴─────────────────────────────────────────────────────────┘

[!NOTE] Exam Trap: Not all Event 4624 logons represent real interactive users. For example, Service Accounts and Computer Accounts (e.g., WORKSTATION01$) generate frequent Event 4624 Type 3 network logons. Administrators must configure User-ID Ignored Users (such as *$ or Administrator) in the User-ID Agent or PAN-OS configuration to prevent computer accounts from overwriting legitimate user mappings.

Syslog Listening & GlobalProtect Identity Mapping

In environments with heterogeneous operating systems (macOS, Linux, iOS, Android, IoT) or non-domain-joined devices, Windows event log parsing cannot provide complete user visibility. PAN-OS addresses this through the Syslog Listener.

Syslog Parse Profiles

The firewall configures an internal UDP/TCP Syslog server that listens for authentication records emitted by:

802.1X NAC Platforms: Cisco ISE, Aruba ClearPass, Extreme Networks Control.
Wireless LAN Controllers (WLCs): RADIUS accounting messages generated when mobile devices associate with enterprise SSIDs.
VPN Concentrators & Proxies: Third-party remote access servers.

Administrators configure Syslog Parse Profiles under Device > User Identification > User Mapping > Syslog Filters. Using regular expressions with named capture groups, PAN-OS extracts:

Event Regex: Identifies successful authentication messages.
Username Regex: Isolates the username string.
IP Address Regex: Extracts the allocated IPv4 or IPv6 address.

GlobalProtect Mapping

When mobile or remote employees connect to a GlobalProtect Gateway, identity mapping occurs directly at the firewall dataplane. The gateway authenticates the user via SAML 2.0, RADIUS, or LDAP, and automatically binds the assigned virtual tunnel IP address to the user identity. Because GlobalProtect possesses authoritative state on tunnel establishment and disconnection, GlobalProtect mappings have the highest priority and immediately clear upon tunnel termination.

Group Mapping & The Cloud Identity Engine (CIE)

Mapping an IP address to a username is only the first step; security policies are authored around functional enterprise groups (e.g., Engineering-Staff, Medical-Doctors). PAN-OS queries directory structures to determine group membership through Group Mapping Profiles and the Cloud Identity Engine.

   On-Premises Architecture:                   Cloud-Native / Hybrid Architecture:

┌───────────────────────────────┐           ┌───────────────────────────────────┐
│ On-Prem Active Directory      │           │ Microsoft Entra ID / Okta / CIE   │
│ (LDAP Port 389 / LDAPS 636)   │           │ (SCIM 2.0 Cloud Sync over HTTPS)  │
└───────────────┬───────────────┘           └─────────────────┬─────────────────┘
                │                                             │
                ▼                                             ▼
┌───────────────────────────────┐           ┌───────────────────────────────────┐
│ PAN-OS Group Mapping Profile  │           │ Cloud Identity Engine (CIE) Agent │
│ - Base DN: DC=corp,DC=local   │           │ - Centralized Cloud Directory     │
│ - objectClass=group           │           │ - Push to firewalls & Prisma      │
│ - Local Cache on Firewall     │           │   Access in real time             │
└───────────────────────────────┘           └───────────────────────────────────┘

Traditional LDAP Group Mapping

The firewall connects to Active Directory or an RFC-compliant LDAP directory via LDAP (port 389) or secure LDAPS (port 636). The administrator defines:

Base DN: The root distinguished name search branch (e.g., OU=Corporate,DC=corp,DC=local).
User/Group Object Classes: Identifies directory schemas (e.g., objectClass=user, objectClass=group, and the memberOf attribute).
Group Include List: Limits cached directory trees to specific security groups used in policy rules, conserving management plane memory.

Cloud Identity Engine (CIE)

Modern hybrid enterprises frequently manage identities in Microsoft Entra ID (formerly Azure AD), Okta, or Google Workspace. These cloud directories do not expose standard LDAP listeners to on-premises networks.

The Cloud Identity Engine (CIE) is a Palo Alto Networks cloud service that connects to cloud identity providers via SCIM 2.0 (System for Cross-domain Identity Management) and SAML. CIE continuously synchronizes users, groups, and attributes into a centralized cloud repository. On-premises firewalls and Prisma Access nodes query CIE over secure HTTPS, enabling seamless group-based policy enforcement across hybrid and multi-tenant architectures without requiring on-premises Active Directory infrastructure.

Terminal Services (TS) Agent for Citrix & RDS Multi-User Platforms

In standard environments, each endpoint workstation possesses a unique IP address. However, in Citrix XenApp, Microsoft Remote Desktop Services (RDS), and shared terminal servers, dozens or hundreds of distinct employees simultaneously log into the same multi-user host. Every outgoing network packet shares the exact same source IP address.

If standard User-ID were applied, the firewall would overwrite the IP mapping with each successive logon, attributing all network traffic to the last user who connected. This represents a critical policy vulnerability.

Multi-User Terminal Server (IP: 10.50.1.100)
┌───────────────────────────────────────────────────────────┐
│ User A (Finance)    ──> Allocated Source Ports: 20000-20199│
│ User B (Engineering)──> Allocated Source Ports: 20200-20399│
│ User C (Contractor) ──> Allocated Source Ports: 20400-20599│
└─────────────────────────────┬─────────────────────────────┘
                              │
                              ▼
            ┌───────────────────────────────────┐
            │      PAN-OS Firewall Dataplane    │
            ├───────────────────────────────────┤
            │ Ingress: 10.50.1.100:20045        │
            │ Map: 10.50.1.100 + Port 20045     │
            │ Result: User A (Finance)          │
            │ Policy: Permit Finance Rules Only │
            └───────────────────────────────────┘

The Palo Alto Networks Terminal Services (TS) Agent resolves this problem:

The TS Agent is installed directly on the Windows Terminal Server.
It binds to the Windows Filtering Platform (WFP) kernel network driver.
When a user logs in, the TS Agent assigns that user a dedicated, unique block of source ports (e.g., 200 ports per user, configurable from 20000 to 65535).
When an application on the terminal server requests an outbound network socket, the TS Agent ensures the operating system assigns a port from that specific user's allocated range.
The TS Agent notifies the PAN-OS firewall over SSL (TCP port 5009), sending the IP address, username, and allocated port range.
When the firewall evaluates outbound traffic, it identifies the user using the IP address + Source Port combination.

Dynamic User Groups (DUGs) & Automated Security Tagging

Traditional directory groups are static; modifying an Active Directory security group requires administrative intervention, approval tickets, and directory replication delay. In incident response and Zero Trust architectures, access rights must adapt dynamically.

Dynamic User Groups (DUGs) allow administrators to create security policy rules that reference metadata tags rather than static LDAP objects. Usernames dynamically join or leave a DUG based on tags registered in the firewall's internal tag table.

┌────────────────────────────────────────────────────────────────────────┐
│                  Automated DUG Incident Response Flow                  │
├────────────────────────────────────────────────────────────────────────┤
│ 1. Endpoint User downloads malicious C2 payload.                       │
│ 2. PAN-OS Anti-Spyware Profile detects DNS Sinkhole hit.              │
│ 3. Automated Log Forwarding Rule executes:                             │
│      Action: Add Tag -> 'compromised-user' (Timeout: 4 hours)          │
│ 4. User 'corp\jsmith' is immediately tagged as 'compromised-user'.     │
│ 5. Dynamic User Group 'Quarantined-Users' matches tag 'compromised'.   │
│ 6. Top Security Rule 'Deny-Quarantined-Access' takes effect INSTANTLY. │
│    NO CONFIGURATION COMMIT REQUIRED!                                   │
└────────────────────────────────────────────────────────────────────────┘

Tagging Mechanisms for DUGs

Automated Log Action: A threat log (Anti-Spyware, Vulnerability Protection, WildFire) or authentication failure triggers an automated built-in action to tag the source user.
PAN-OS XML API / REST API: External security tools, such as Cortex XSOAR, Splunk, or CrowdStrike, execute an API call to tag or untag users upon threat detection.
GlobalProtect HIP (Host Information Profile): If an endpoint fails compliance (e.g., antivirus disabled, disk unencrypted), the user is tagged dynamically.

Because DUG membership evaluation executes dynamically within the dataplane memory, policy enforcement takes effect in sub-second time without requiring a firewall commit.

CLI Diagnostics & Operational Verification

Security engineers verify User-ID mappings, group resolutions, and TS Agent operational health using dedicated CLI tools:

# Display all active IP-to-user mappings across all sources
admin@PA-5450> show user ip-user-mapping all

IP                  Vsys   From    User                             IdleTimeout(s) MaxTimeout(s)
------------------- ------ ------- -------------------------------- -------------- -------------
10.1.1.50           vsys1  UIA     corp\jsmith                      2345           28745
10.1.1.75           vsys1  GP      corp\mgarcia                     1890           21500
10.50.1.100         vsys1  TS-Agent corp\rlee (Ports: 20000-20199)   1200           14400

# Inspect detailed mapping provenance for a specific IP address
admin@PA-5450> show user ip-user-mapping ip 10.1.1.50

IP address:      10.1.1.50
User:            corp\jsmith
Type:            Active Directory
Source:          Agentless-WinRM-DC01
Timeout:         2345s
Groups:          corp\Domain Users, corp\Finance-Staff, corp\VPN-Users

# List all cached LDAP directory groups available for policy enforcement
admin@PA-5450> show user group list

[1] cn=finance-staff,ou=groups,dc=corp,dc=local
[2] cn=it-admins,ou=groups,dc=corp,dc=local
[3] cn=domain users,cn=users,dc=corp,dc=local

# Verify operational connectivity and status of Terminal Services Agents
admin@PA-5450> show user ts-agent state all

Agent: TS-Agent-Farm01 (10.50.1.100:5009)
    Status: Connected
    Version: 10.2.0
    Active Users: 42
    Allocated Port Range: 20000 - 65535

# Clear cached user mappings during troubleshooting
admin@PA-5450> clear user-cache ip 10.1.1.50

Test Your Knowledge

In a remote desktop deployment where multiple employees log into a shared Microsoft Remote Desktop Services (RDS) session host, how does PAN-OS distinguish individual user traffic originating from the host's single IP address?

The TS Agent assigns unique virtual IPv6 addresses to each client thread and tunnels them via GRE to the firewall.

The TS Agent executes a WMI query to Active Directory every time an RDS user launches a browser session.

The TS Agent replaces the firewall dataplane routing table by injecting host routes for each active Citrix session.

The TS Agent allocates distinct, dedicated source port ranges to individual concurrent users sharing a single server IP address.

Test Your Knowledge

Which Windows Security Event ID provides the primary logon timestamp, username, and client IP address needed by the User-ID engine to establish a valid IP-to-user mapping in an Active Directory environment?

Event ID 4624 records successful user logons across interactive and network logon types, providing primary IP-to-username binding data.

Event ID 1102 records audit log clearings and triggers immediate user session termination in the User-ID cache.

Event ID 4720 records user account creation and automatically binds the administrator's IP to the new user object.

Event ID 4672 records administrative privilege assignment and establishes DUG membership without requiring logon events.

Test Your Knowledge

A security operations team wants to immediately isolate an endpoint user whose workstation generates command-and-control traffic without waiting for an Active Directory group update or initiating a firewall commit. Which PAN-OS feature enables this automated workflow?

Configuring an LDAP Group Mapping profile with a one-minute polling interval to query security groups.

Configuring a Dynamic User Group (DUG) that matches an automated security tag applied to the username via log forwarding.

Configuring a Terminal Services Agent policy to quarantine the source MAC address at the ingress interface.

Configuring an Application Override policy that dynamically routes the user's traffic to a blackhole virtual router.

Up Next

2.3 Security Policy Enforcement & NAT Architecture

Continue learning

Palo Alto Networks Certified Network Security Professional

Palo Alto Networks Certified Network Security Professional

2.2 User-ID Architecture, Identity Mapping & Group Enforcement

Key Takeaways

2.2 User-ID Architecture, Identity Mapping & Group Enforcement

User-ID Mapping Architecture & Mechanisms

User-ID Mapping Ingestion Sources

Windows-Based User-ID Agent vs. Integrated Agentless Engine

Transport Protocol Considerations: WinRM vs. WMI

Active Directory Security Event Log Parsing Mechanics

Syslog Listening & GlobalProtect Identity Mapping

Syslog Parse Profiles

GlobalProtect Mapping

Group Mapping & The Cloud Identity Engine (CIE)

Traditional LDAP Group Mapping

Cloud Identity Engine (CIE)

Terminal Services (TS) Agent for Citrix & RDS Multi-User Platforms

Dynamic User Groups (DUGs) & Automated Security Tagging

Tagging Mechanisms for DUGs

CLI Diagnostics & Operational Verification

Palo Alto Networks Certified Network Security Professional

1Chapter 1: PAN-OS Architecture, Interfaces & Routing

2Chapter 2: PAN-OS Core Policy, App-ID & NAT

3Chapter 3: SSL/TLS Decryption Architecture & Policy

4Chapter 4: Cloud-Delivered Security Services (CDSS) & Threat Prevention

5Chapter 5: Prisma Access Infrastructure & Network Onboarding

6Chapter 6: ZTNA 2.0, Cloud Identity & Digital Experience

7Chapter 7: Strata Cloud Manager (SCM) & AI-Driven Management

8Chapter 8: Prisma SD-WAN & Branch Edge Architecture

9Chapter 9: GlobalProtect, Cloud NGFW & AI Runtime Security

10Chapter 10: Packet Processing Architecture & System Troubleshooting

11Chapter 11: Panorama, Subscriptions, Digital Trust & Quantum Readiness

Palo Alto Networks Certified Network Security Professional

2.2 User-ID Architecture, Identity Mapping & Group Enforcement

Key Takeaways

2.2 User-ID Architecture, Identity Mapping & Group Enforcement

User-ID Mapping Architecture & Mechanisms

User-ID Mapping Ingestion Sources

Windows-Based User-ID Agent vs. Integrated Agentless Engine

Transport Protocol Considerations: WinRM vs. WMI

Active Directory Security Event Log Parsing Mechanics

Syslog Listening & GlobalProtect Identity Mapping

Syslog Parse Profiles

GlobalProtect Mapping

Group Mapping & The Cloud Identity Engine (CIE)

Traditional LDAP Group Mapping

Cloud Identity Engine (CIE)

Terminal Services (TS) Agent for Citrix & RDS Multi-User Platforms

Dynamic User Groups (DUGs) & Automated Security Tagging

Tagging Mechanisms for DUGs

CLI Diagnostics & Operational Verification