> Source: [sk183679](https://support.checkpoint.com/results/sk/sk183679)

# sk183679 - Users Cannot Access Group-Based Resources in Mobile Access Portal with Microsoft Entra ID Integration

| Property | Value |
|----------|-------|
| Solution ID | sk183679 |
| Date Created | 2025-07-21 |
| Last Modified | 2025-07-28 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * Users can authenticate and log in to the Mobile Access Portal (also known as SSL VPN) using Microsoft Entra ID (formerly Azure Active Directory).

* After successful login, users do not see group-assigned resources in the portal (for example, the "World Clock" web application is missing).

* When the Access Role that uses an Identity Tag is replaced with a generic 'Any' role, the expected resources become visible.

* The SmartConsole log displays the message:  

  ```
  User does not belong to any group.
  ```

  <br />

* Running the Identity Awareness commands:`"# pdp m u <username>"` and `"# pdp m I <IP_address>"` the output shows show no group membership for the user.

* The group's Cloud ID is missing from the management database. To verify, run the following command on the Management Server:  

  `
  # psql_client cpm postgres -c "select cloudid, cmsuid, objid, name from cloudshadowobject_data cl where cloudid ilike '%<CLOUDID>';"`  


  replace CLOUDID with the actual Cloud ID.

## Cause

An incorrect configuration in the Security Assertion Markup Language (SAML) settings within Microsoft Entra ID.  
Specifically:  

* The group claim (`group_attr`) is not configured to send the group Object ID.
* As a result, Check Point Identity Awareness cannot determine the user's group membership.
* Access Roles using Identity Tags fail because the system cannot match the user to a defined group.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content