Frequently Asked Questions

Who can I reach out to with questions and feedback?
If you ever have any questions about the self-service version of the Best Practice Assessment for NGFW and Panorama (BPA), process, materials or have suggestions on how to make improvements, please reach out to us at

After a customer runs a BPA, can we see the results of the report?
The full HTML report is only available during the BPA generation process. If you have the Tech Support File (TSF), then you may generate and view the full HTML report yourself. If you do not have the TSF, it will be up to the customer to share the full report with you. However, the customer may grant employees and partners the ability to view a customer’s BPA Executive Summary. In the Customer Support Portal (CSP), we have to delegate RBAC to the customer due to SOX compliance. With that, the Super User of the CSP account has to first add the employee/partner to the CSP account, then assign the “BPA User” role to that person’s profile. There is no getting around this requirement for compliance reasons.
Where can I go to learn more about the overall functionality of the BPA and corresponding programs?
Both partners and sales can each refer to their own portals to learn about the BPA, access marketing materials, and receive additional training and support.
Partner Portal
Sales Enablement Kit
How can we see which customers have run reports?
Palo Alto Networks employees (the account and service teams) receive automated email notifications when one of their accounts generates an assessment.
All Channel Partners should refer to their Channel Business Managers (CBM). CBMs have access to dashboards that display the accounts who have run an assessment and belong to their partner. CBMs are encouraged to share the information with the respective partner teams.
Is there a customer training available for the self-service version of the BPA?
Yes, there are multiple customer facing training resources available on our live community as well as an on-demand recording of the Best Practices Workshop
Is there a limit to how many reports a customer can generate? Are they limited in the number of devices that they can assess at a time?
While there is no limit in the total number of reports that they can run, customers will not have the ability to upload multiple TSFs at the same time. But, they can generate a BPA for individual NGFWs or their Panorama device.
Will the default classification categories be ported over from previously run assessments?
The area of architecture classification mapping will be retained from previously generated assessments. So, customers don’t have to map all of their Device Group + Zones again in the future with the exception of brand-new combinations not previously seen.
Where can I get trained on the self-service version of the BPA?
Since the tool itself is not changing, the current training curriculum still applies and can be accessed in our Learning Management System. For BPA Insights Webinar please visit this page.
I would like to reach out to my customer to let them know about this. Where can I go for marketing and sales resources?
Where can I (or my customers go) to generate a BPA?
The URL for the Customer Support Portal (where customers can generate a BPA under the Tools section) is
The vanity URL that links directly to the BPA within the CSP is
Partners can generate a BPA from
Employees may generate a BPA within Salesforce.
What will the "assessment history" page show for the customer?
The assessment history page will display all of the reports generated by the customer as well as provide the ability to view an executive summary for an existing BPA that was generated by a customer.
When is the Self-Service version of the BPA available to customers?
The self-service version of the BPA is available to customers on November 14, 2018. The tool will be available on the Customer Support Portal and can be accessed with this URL
Under the architecture categories (step 2 in the wizard), will the categories come as a default setting? Or will they leverage the category settings that were set when an assessment was previously run for that customer by the SE or Partner?
The area of architecture classification mapping will be retained from previously generated reports. So, a customer will not have to map all of their Device Group + Zones again in the future with the exception of brand-new combinations not previously seen.
What is the difference between the Best Practice Assessment and the Security Lifecycle Review (SLR)?
Simply put, the BPA focuses on Palo Alto Networks policy configurations, rule sets, device groups, and capability adoption across the network. The Security Lifecycle Review (SLR) is an analysis of the threats, applications, traffic that are found traversing the customer's network.
Are there any plans to send proactive notifications to customers about this tool becoming available to them? Or communication will be done through customer outreach kits only?
Customers will be informed of the self-service version of the BPA availability over time through marketing campaigns/programs, sales and partner outreach, and with live event promotion. The launch of the BPA will consist of a targeted outreach to all customers who have run an assessment (globally) inviting them to participate in a Best Practices Workshop (introducing the self-service version of the BPA and walking them through the report)
Will customers also be able to access the Heatmap report component of the self-service version of the BPA?
Because the Heatmap and BPA are now one combined report, users will be able to access both assessment’s data via different views within one all-inclusive report. Customers can intuitively switch between the different tabs of the report to view each.
Will a customer be able to transfer their previously run assessments into the Customer Support Portal? Will there be an option to upload historical report data for comparisons sake?
The history shown in the adoption trending view will include all historical data we have available in the database for a given serial number. As long as the customer has their devices registered in the Customer Support Portal, they will be able to compare progress in the trending views. However, they will not see previously generated BPA reports in the “History” view within the Customer Support Portal.
Where can I (or my customers go) to learn more about Palo Alto Networks best practices?
Check out our technical documentation for the Palo Alto Networks Security Operating Platform
Why are we giving customers to access the BPA?
Our intent is to offer customers a proactive approach to security. With results of their deployment at their fingertips, we can guide individuals to the resources that can help them improve their overall prevention strategy. This will consist of Tech Docs, Transformation Services, and engagements with their account teams and partners.
What happens when a customer experiences an issue when generating an assessment? Who will get notified?
Automated notifications are in place so that if an error occurs while the customer is generating a BPA, the appropriate IT, Dev and Automation and Analytics teams are notified and will investigate the issue and troubleshoot accordingly.