diff --git a/cpacfstats/cpacfstats.1 b/cpacfstats/cpacfstats.1
index ac618488..f5604749 100644
--- a/cpacfstats/cpacfstats.1
+++ b/cpacfstats/cpacfstats.1
@@ -179,6 +179,12 @@ the errno value.
 ECC counters are only available since z15. cpacfstats will show the
 counters as \fIunsupported\fR if the hardware does not support ECC
 counters.
+
+CPU-MF counters have to be authorized on HMC or SE to be available and are
+otherwise shown as \fIunauthorized\fR. On the HMC or SE, authorize the LPAR
+for each counter set you want to use. Customize the LPAR activation profile
+and modify the Counter Facility Security Options. You need to activate the
+\fICrypto activity counter set authorization control\fR checkbox.
 .
 .SH APPENDIX
 The detailed pai counter names are:
diff --git a/cpacfstats/cpacfstats.c b/cpacfstats/cpacfstats.c
index 626475a8..bd108721 100644
--- a/cpacfstats/cpacfstats.c
+++ b/cpacfstats/cpacfstats.c
@@ -175,9 +175,10 @@ static void print_virtual_counter_answer(int s,
 					 int ctr, int state, uint64_t value)
 {
 	static const char *const states[] = {
-		[DISABLED]    = "disabled",
-		[ENABLED]     = "enabled",
-		[UNSUPPORTED] = "unsupported"
+		[DISABLED]     = "disabled",
+		[ENABLED]      = "enabled",
+		[UNSUPPORTED]  = "unsupported",
+		[UNAUTHORIZED] = "unauthorized"
 	};
 	int paictr = 0, paistate = 0, ec;
 	uint64_t i, paivalue = 0;
@@ -242,6 +243,8 @@ static void print_answer(int s, int ctr, int state, uint64_t value)
 		printf(" %s counter: disabled\n", counter_str[ctr]);
 	else if (state == UNSUPPORTED)
 		printf(" %s counter: unsupported\n", counter_str[ctr]);
+	else if (state == UNAUTHORIZED)
+		printf(" %s counter: unauthorized\n", counter_str[ctr]);
 	else
 		printf(" %s counter: %lu\n", counter_str[ctr], value);
 }
diff --git a/cpacfstats/cpacfstats.h b/cpacfstats/cpacfstats.h
index a5514b8c..b6d59acd 100644
--- a/cpacfstats/cpacfstats.h
+++ b/cpacfstats/cpacfstats.h
@@ -74,7 +74,8 @@ enum cmd_e {
 enum state_e {
 	DISABLED = 0,
 	ENABLED,
-	UNSUPPORTED
+	UNSUPPORTED,
+	UNAUTHORIZED
 };
 
 enum counter_type {
diff --git a/cpacfstats/cpacfstatsd.c b/cpacfstats/cpacfstatsd.c
index ed57d0d1..b824d626 100644
--- a/cpacfstats/cpacfstatsd.c
+++ b/cpacfstats/cpacfstatsd.c
@@ -179,7 +179,7 @@ static int do_enable(int s, enum ctr_e ctr, unsigned int *supported_counters)
 				}
 				state = ENABLED;
 			}
-			if (state != UNSUPPORTED) {
+			if (state != UNSUPPORTED && state != UNAUTHORIZED) {
 				rc = perf_read_ctr(i, &value, supported_counters);
 				if (rc != 0) {
 					send_answer(s, i, rc, 0);
diff --git a/cpacfstats/perf_crypto.c b/cpacfstats/perf_crypto.c
index ec816677..68a6bd09 100644
--- a/cpacfstats/perf_crypto.c
+++ b/cpacfstats/perf_crypto.c
@@ -141,6 +141,10 @@ static int perf_counter_supported(const char *pmu, const char *counter)
 	return !access(buf, R_OK);
 }
 
+/**
+ * Returns 1 if counters are authorized, -1 if counters are unauthorized,
+ * and 0 otherwise which indicates that the counters are unsupported
+ */
 static int cpumf_authorized(void)
 {
 	unsigned vermin, vermax, auth;
@@ -159,10 +163,12 @@ static int cpumf_authorized(void)
 		if (sscanf(line,
 			   "CPU-MF: Counter facility: version=%d.%d authorization=%x",
 			   &vermin, &vermax, &auth) == 3) {
-			if (auth & 0x8)
+			if (auth & 0x8) {
 				res = 1;
-			else
+			} else {
 				eprint("CPU-MF counters not authorized.\n");
+				res = -1;
+			}
 			found = 1;
 			break;
 		}
@@ -233,7 +239,7 @@ static int activatecpu(unsigned int cpu, unsigned int *supported_counters)
 	}
 	/* activate CPU-MF */
 	for (i = 0; i < ALL_COUNTER; ++i) {
-		if (ctr_state[i] == UNSUPPORTED)
+		if (ctr_state[i] == UNSUPPORTED || ctr_state[i] == UNAUTHORIZED)
 			continue;
 		memset(&pfm_event, 0, sizeof(pfm_event));
 		pfm_event.size = sizeof(pfm_event);
@@ -398,7 +404,7 @@ static int perf_load_counter_data(void)
 	int i, res = 0;
 
 	for (i = 0; i < ALL_COUNTER; ++i) {
-		if (ctr_state[i] != UNSUPPORTED)
+		if (ctr_state[i] != UNSUPPORTED && ctr_state[i] != UNAUTHORIZED)
 			res |= perf_event_encode(&pmf_counter_data[i].pmutype,
 						 &pmf_counter_data[i].eventid,
 						 pmf_counter_name[i].pmu,
@@ -474,6 +480,7 @@ int perf_init(unsigned int *supported_counters)
 	};
 	unsigned long maxfd;
 	struct rlimit rlim;
+	int cpumf_state;
 	int i, num;
 	FILE *f;
 
@@ -487,10 +494,15 @@ int perf_init(unsigned int *supported_counters)
 	 * counters for PAI. */
 	num = ALL_COUNTER + 2;
 
-	if (!cpumf_authorized()) {
+	cpumf_state = cpumf_authorized();
+	if (cpumf_state == 0) {
 		for (i = 0; i < ALL_COUNTER; ++i)
 			ctr_state[i] = UNSUPPORTED;
 		num -= ALL_COUNTER;
+	} else if (cpumf_state == -1) {
+		for (i = 0; i < ALL_COUNTER; ++i)
+			ctr_state[i] = UNAUTHORIZED;
+		num -= ALL_COUNTER;
 	} else {
 		for (i = 0; i < ALL_COUNTER; i++) {
 			if (!perf_counter_supported("cpum_cf", cpum_cf[i])) {