Explanation
To obtain user mappings from existing network services that authenticate users-such as wireless controllers,
802.1x devices, Apple Open Directory servers, proxy servers, or other Network Access Control (NAC) mechanisms-Configure User-ID to Monitor Syslog Senders for User Mapping.While you can configure either the Windows agent or the PAN-OS integrated User-ID agent on the firewall to listen for authentication syslog messages from the network services, because only the PAN-OS integrated agent supports syslog listening over TLS, it is the preferred configuration.
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/user-id/user-id-overview.html
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/user-id/map-ip-addresses-to-users