PnP Error

Trying to find out why PnP job's in the projects panel of the APIC-EM dashboard are showing this error:

 Received response from pnp agent for message correlatorId: CiscoPnP-1.0-34-279-3C1CD910-34 but with error code : ZTD_CMD_ERROR Response String: PERMISSION_DENIED:authorization failed

Tried it with and without a username and password to the bulk upload file and the configurations/image seems to get deployed to the switch just fine.   Using the latest APIC-EM build with basically a base PnP configuration.  The hardware are 3650/3850 switches

 here is the link to the forum post that answers this question:

https://communities.cisco.com/message/228837#228837

Check for the IOS  version that you are running on the switches. 

The fix requires IOS support as well as APIC-EM.

From the PnP release notes:

 AAA device credential support. The AAA credentials are passed to the device securely and the password is not logged. This feature allows provisioning a device with a configuration that contains aaa authorization commands. This feature requires software release IOS 15.6(3)M1, IOS XE 16.3.2, or IOS XE 16.4 or later on the device.