A customer has configured the JIT, and the user created by the process is trying to log in to the Prisma Cloud console. The user encounters the following error message: What is the reason for the error message?

Just-In-Time (JIT) provisioning in Prisma Cloud creates a user account upon their first SSO login. The user's role is assigned based on attributes (e.g., group membership) passed in the SAML assertion from the Identity Provider (IdP). If the "Role Attribute Name" configured in Prisma Cloud's SSO settings does not exactly match the attribute name sent by the IdP, Prisma Cloud cannot extract the role information. This failure to map a role prevents the user's account from being fully provisioned, leading to a login error.

B. The user does not exist. The purpose of JIT is to create the user on their first login, so the user not existing beforehand is expected behavior, not an error.
C. The user entered an incorrect password. Password authentication happens at the Identity Provider (IdP). An incorrect password would cause a failure at the IdP, before the user is redirected to Prisma Cloud.
D. The role is not assigned for the user. This is a symptom of the problem, not the root cause. The role is not assigned because the attribute name is misconfigured, preventing the role mapping.

1. Palo Alto Networks, Prisma Cloud Administrator's Guide (SaaS), "Integrate Prisma Cloud with an Identity Provider for SSO". The guide details the configuration steps for JIT, emphasizing the need to correctly specify the "Role Attribute Name" and "Account Group Attribute Name" to match the attributes sent by the IdP. A mismatch in these names is a common cause of JIT failure.