Hello,
My compnay is currently migrating from On-prem AD to Entra ID. Currently We have both setup in ISE. Both are generally working but I am working through a group query issue with Entra ID. I have two separate policy sets. The old one for AD on-prem and the new one for Entra ID. I manually add the calling-station-id to the policy condition to specify the computers that I want to hit the Entra ID policy set. For the Entra ID policy set I have an Authorization rule setup to with a few parameters, one them being the Entra Group name. The group name in use is IT. This policy is called IT-Network Access. The issue I run into is that my test computer will sometimes hit the IT-Network Access policy and sometimes will not. I did some digging and I can see on the Authentication detail report there are always 3 AD-Groups-Names retrieved but, they seem to change on each Auth attempts since my account matches more than three groups. Sometimes the IT group will show in my authentication detail and that sessions that hit my IT-Network Access authorization rule. On the auth session that I do not hit this policy the IT group will not be in my authentication detail but 3 other groups will be there. Some of these groups that are populated are the On-prem AD groups and some are the Entra ID. My workaround was to add more groups both, AD and Entra, to my authorization policy, however I feel like that could get a little messy once I add more authorization policies for the different access cases.
The queries are based on the sbuject name provided in the cert (EAP-TLS). My subject name will technically be matched in AD and Entra. I want to limit auth sessions for this policy set to only query the Entra ID groups. Is that possible to control?
