Setup Entra ID Group Filters in Privilege Elevation Policies

Privilege Elevation Group Filters do not Match Azure AD Users

When an Entra ID (Azure AD) user is selected through a group collection, the Privilege Elevation policy can be evaluated as if the user is not a member. Enforcement is silently skipped and native Windows UAC is shown instead.

A group added directly to a Privilege Elevation policy passes the control. The same group added through a group collection fails with EnforcementDisabled.

What this Procedure Fixes

One-Time Tenant Setup

Register a native/public client in Microsoft Entra ID so the endpoint can resolve the signed-in user's group membership.

Encrypted Endpoint Configuration

Deliver the Application (client) ID through a SettingsUpdate policy. No client secret is required.

1

One-Time per Tenant

Get the Entra client ID

In the Azure portal, open Entra ID → App registrations → New registration. Use any name and choose Single tenant unless your organization requires another account type.

Register a native/public client application. The name is not used by the endpoint.

Add the Mobile and Desktop Redirect URI

Windows: Under Redirect URI, select Mobile and desktop applications and add the following URL. Replace CLIENT_ID with the client_id of this app registration.

ms-appx-web://Microsoft.AAD.BrokerPlugin/<CLIENT_ID>.

MacOS: Under Redirect URI, select iOS/macOS and add the following Bundle ID

com.keeper.endpoint-privilege-manager.usergroupresolver

Make sure Allow public client flow is Enabled

Keep the Default Delegated Permission

Leave Microsoft Graph User.Read (delegated) in place. Copy the application's Application (client) ID; this is the ClientId value used in the next step.

Click Grant admin consent for Default Directory and select Yes

Select the Mobile and desktop applications platform and use the native-client redirect URI.

Consent: If the tenant requires administrator consent for delegated permissions, grant consent once. The first sign-in for each user may still show an interactive consent prompt; silent token acquisition cannot grant consent.

2

Deploy to the Endpoint

Push the Client ID with a Secure Settings Policy

Deploy this SettingsUpdate policy. Replace the placeholder with the client ID copied in Part 1. The sample is also available at src/KeeperPEDM_VS2022/Examples/sample/UserGroupResolver-ClientId-SecureSettingsPolicy.json.

{
  "PolicyId": "usergroupresolver-clientid-secure",
  "PolicyName": "UserGroupResolver Entra ClientId (encrypted)",
  "PolicyType": "SettingsUpdate",
  "Status": "enforce",
  "Extension": {
    "Action": "Update",
    "SecureSettings": {
      "UserGroupResolver:ClientId": "<your Application (client) ID from Part 1>"
    }
  }
}

Full Policy Example

{
	"PolicyName": "Assign Azure Client ID",
	"PolicyType": "SettingsUpdate",
	"PolicyId": "AdCKQ7svb7yvsvWH5QYKgg",
	"Status": "enforce",
	"Actions": {
		"OnSuccess": {
			"Controls": []
		},
		"OnFailure": {
			"Command": ""
		}
	},
	"NotificationMessage": "A policy has been set to monitor mode.  When this policy is enabled, [mfa, justification, request] will be required to run this process as an administrator.",
	"NotificationRequiresAcknowledge": false,
	"RiskLevel": 50,
	"Operator": "And",
	"Rules": [
		{
			"RuleName": "UserCheck",
			"ErrorMessage": "This user is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckUser()"
		},
		{
			"RuleName": "MachineCheck",
			"ErrorMessage": "This Machine is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckMachine()"
		},
		{
			"RuleName": "ApplicationCheck",
			"ErrorMessage": "This application is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckFile(false)"
		},
		{
			"RuleName": "DateCheck",
			"ErrorMessage": "Current date is not covered by this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckDate()"
		},
		{
			"RuleName": "TimeCheck",
			"ErrorMessage": "Current time is not covered by this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckTime()"
		},
		{
			"RuleName": "DayCheck",
			"ErrorMessage": "Today is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckDay()"
		},
		{
			"RuleName": "CertificateCheck",
			"ErrorMessage": "Certificate hash is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckCertificate()"
		}
	],
	"UserCheck": [
		"*"
	],
	"MachineCheck": [
		"*"
	],
	"ApplicationCheck": [
		"*"
	],
	"DayCheck": [],
	"DateCheck": [],
	"TimeCheck": [],
	"CertificationCheck": [],
	"Extension": {
		"Action": "Update",
		"SecureSettings": {
			"UserGroupResolver:ClientId": "<your Application (client) ID from Part 1>"
		}
	}
}

• The policy status is enforce.

• The value is the Application (client) ID, not the object ID or directory (tenant) ID.

• The value is stored under SecureSettings; do not distribute a client secret.

3

Validate Policy Matching

Add the Group Directly to Privilege Elevation Policy

Create or edit a Privilege Elevation policy, add the Entra group as a group filter directly (not as a collection), and test the policy with any control.

Expected: control passes

The group membership resolves and the Privilege Elevation policy is enforced.

4

Reproduce the Collection Issue

Add the Group through a Group Collection

Repeat the test, but add the same Entra group through a group collection instead of adding the group directly to the Privilege Elevation policy.

Direct Group Filter

Control passes and the Privilege Elevation policy is applied.

Group Collection Filter

Control fails with EnforcementDisabled; native UAC appears instead.

If the direct-group test passes but the collection test returns EnforcementDisabled, the endpoint is reproducing the Azure AD group collection filter issue described on this page. Confirm the client ID policy and collect endpoint logs before escalating.

---

Troubleshooting

Example of Command Prompt for Troubleshooting

C:\Users\JohnDoe>"C:\Program Files\Keeper Security\Endpoint Privilege Manager\Jobs\bin\UserGroupResolver\UserGroupResolver.exe" --dry-run --client-id <your Application (client) ID from Part 1>

Example of Successful Response

{
    "userSid": "S-1-12-1-1230035805-203337995-2932204708-3501512273",
    "userName": "AzureAD\\JohnDoe",
    "windowsStatus": "Ok",
    "entraStatus": "Ok",
    "local": [
        {
            "name": "Remote Desktop Users",
            "sid": "S-1-5-32-555"
        },
        {
            "name": "Users",
            "sid": "S-1-5-32-545"
        }
    ],
    "ad": [],
    "azure": [
        {
            "sid": "S-1-12-1-3835191376-1160143123-1997930151-2855338395",
            "domain": "AzureAD",
            "id": "e4986050-6113-4526-a7fe-15779b0131aa"
        },
        {
            "sid": "S-1-12-1-3739764121-1102381688-1139556528-502970863",
            "domain": "AzureAD",
            "id": "dee84599-0278-41b5-b040-ec43efb9fa1d"
        }
    ]
}

---

Related Pages

• Privilege Elevation Policy

• Policy Evaluation

• Reference Targeting

• Configuration Settings