Because the on-premises firewall is redistributing User-ID information into Prisma Access over the service connection, the redistribution agent object must be configured within the template that actually governs the service connection ' s dataplane — the Service_Conn_Template — not the Remote_Network_Template, which applies to a different set of nodes entirely and would leave the redistribution agent unreachable from the path the data is actually traversing. Selecting the wrong template is a common and easily overlooked misconfiguration that silently prevents the mapping information from being ingested at all, which is why validating the Service_Conn_Template assignment (option D) is essential. Equally important is the Collector Pre-Shared Key: User-ID redistribution uses this shared secret to authenticate the connection between the redistributing firewall and the receiving collector, and any mismatch between the value configured on the on-premises firewall and the value configured in Prisma Access will cause the redistribution session to fail silently or be rejected, leaving remote network traffic unmapped even though the configuration otherwise looks complete — this is option C. Option A names the wrong template for a service-connection-sourced redistribution scenario, so it does not apply here. Option B, while port 5007 is indeed the standard User-ID redistribution port, describes a downstream security policy check that is secondary to first confirming the agent is bound to the correct template and authenticated correctly; a PSK mismatch or wrong template assignment will prevent the session regardless of policy.