Situation: The client has a PA Firewall. After they added a domain account into Administrator, the user can’t login.
Troubleshooting:
After adding a domain account into Administrator under Device, you also need to add it into Authentication Profile under Device.