In the zone in which User Identification is enabled, create a User Identification ACL Include List using the same IP ranges as those allocated in the DHCP scope.

Under the User Identification settings, under the User Mapping tab, select the "Restrict Users to Allocated IP" checkbox.

In the zone in which User Identification is enabled, select the "Restrict Allocated IP" checkbox.

In the DHCP settings on the Palo Alto Networks firewall, point the DHCP Relay to the IP address of the UserID agent.