Take a look at this doc, really helpful: Critical VLAN with SD-Access - Cisco Community
After you setup critical auth, not sure what auth template you run by default, but if you login to an EN you can look into the IBNS policy and determine the service templates:
DefaultCriticalAuthVlan_SRV_TEMPLATE
DefaultCriticalVoice_SRV_TEMPLATE
Inside there you can identify/verify your config settings (sgt and the default vlan that you assigned as critical)
HTH!