When is it necessary to activate a license when provisioning a new Palo Alto Networks firewall?

While GlobalProtect requires a license for clients, the basic portal configuration itself can be done without an active license, though full functionality relies on it.

User Activity Reports typically rely on User-ID features, which might be bundled or foundational, but don't inherently require a separate, immediate license activation for basic reporting framework beyond the initial firewall license.

Certificate Profiles are a core functionality for SSL decryption and VPNs, and do not typically require a separate license activation for their configuration beyond the base firewall license.

Palo Alto Networks firewalls require specific subscriptions and licenses for threat prevention features like Antivirus, Anti-Spyware, URL Filtering, and WildFire. To receive the latest Antivirus signatures and updates, the Antivirus license must be activated and valid on the firewall.