Palo Alto Global Protect MFA Prompts Twice for Every Sign-On (RADIUS)
Nov 10, 2025
Integrations
Okta Classic Engine
Multi-Factor Authentication
Okta Identity Engine
Overview
Palo Alto Global Protect RADIUS authentication results in two Multi-Factor Authentication (MFA) prompts from Okta before logging the user in.
Applies To
- Palo Alto Global Protect
- RADIUS
Cause
Solution
To resolve this issue, uncheck the MFA requirement for either the gateway or the portal.
Please refer to the Palo Alto KCS article listed in the Related References section of this article for steps to resolve.
