Cisco ISE Entra Drop Access

[hs08]

The cisco entra application have group 'CISCO_ISE_GROUP' and my account is member of that group

but i always got deny access, also i try to trace the session and showing Deny Access

Anyone know why? 

Here my policy set

Test connection in REST ID was succeeded

[ahollifield]

What's the EAP type? Honestly I'm not sure if session trace works for REST ID. Try using a real client. You are using TEAP or EAP-TLS right? Not cleartext EAP-TTLS?