> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/endpoint-privilege-manager/policies/policy-reference/policy-evaluation/setup-entra-id-group-filters-in-privilege-elevation-policies.md).

# Setup Entra ID Group Filters in Privilege Elevation Policies

Privilege Elevation Group Filters do not Match Azure AD Users

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2F134UeA9ylKPDvSTq9BhU%2Fimage.png?alt=media&amp;token=d63c49e9-ce67-4aad-8bff-1b79621dda34" alt=""><figcaption></figcaption></figure>

When an Entra ID (Azure AD) user is selected through a group collection, the Privilege Elevation policy can be evaluated as if the user is not a member. Enforcement is silently skipped and native Windows UAC is shown instead.

{% hint style="danger" %}
A group added directly to a Privilege Elevation policy passes the control. The same group added through a group collection fails with `EnforcementDisabled`.
{% endhint %}

## What this Procedure Fixes <a href="#overview-heading" id="overview-heading"></a>

{% columns %}
{% column %}

### One-Time Tenant Setup

Register a native/public client in Microsoft Entra ID so the endpoint can resolve the signed-in user's group membership.
{% endcolumn %}

{% column %}

### Encrypted Endpoint Configuration

Deliver the Application (client) ID through a `SettingsUpdate` policy. No client secret is required.
{% endcolumn %}
{% endcolumns %}

{% stepper %}
{% step %}

### One-Time per Tenant

### Get the Entra client ID <a href="#client-id-heading" id="client-id-heading"></a>

In the Azure portal, open **Entra ID → App registrations → New registration**. Use any name and choose **Single tenant** unless your organization requires another account type.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2F3Qq63LipsktqlJeGPVYK%2Fimage.png?alt=media&amp;token=4e2ac1e8-bd03-4911-9c66-3ec3b9bc6dfd" alt="Register a native/public client application. The name is not used by the endpoint."><figcaption><p>Register a native/public client application. The name is not used by the endpoint.</p></figcaption></figure>

#### Add the Mobile and Desktop Redirect URI

Under **Redirect URI**, select **Mobile and desktop applications** and add the native client URI shown in the portal. The MSAL/WAM public-client flow uses this redirect.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2Fxh8LbArP0Nhlz1Izsfdf%2Fimage.png?alt=media&amp;token=eac642c5-c0a0-4e98-b0f5-f1b389920f32" alt="Select the Mobile and desktop applications platform and use the native-client redirect URI."><figcaption><p>Select the <strong>Mobile and desktop applications</strong> platform and use the native-client redirect URI.</p></figcaption></figure>

#### Keep the Default Delegated Permission

Leave Microsoft Graph **User.Read** (delegated) in place. Copy the application's **Application (client) ID**; this is the `ClientId` value used in the next step.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2Fr505KqTgRf6WTcWiZDgS%2Fimage.png?alt=media&amp;token=35409462-69eb-4a1e-b6ad-7ca6060de856" alt="The default User.Read delegated permission is sufficient for the native/public-client sign-in flow."><figcaption><p>The default <strong>User.Read</strong> delegated permission is sufficient for the native/public-client sign-in flow.</p></figcaption></figure>

{% hint style="info" %}
**Consent:** If the tenant requires administrator consent for delegated permissions, grant consent once. The first sign-in for each user may still show an interactive consent prompt; silent token acquisition cannot grant consent.
{% endhint %}
{% endstep %}

{% step %}

### Deploy to the Endpoint

### Push the Client ID with a Secure Settings Policy <a href="#secure-settings-heading" id="secure-settings-heading"></a>

Deploy this `SettingsUpdate` policy. Replace the placeholder with the client ID copied in Part 1. The sample is also available at `src/KeeperPEDM_VS2022/Examples/sample/UserGroupResolver-ClientId-SecureSettingsPolicy.json`.

```
{
  "PolicyId": "usergroupresolver-clientid-secure",
  "PolicyName": "UserGroupResolver Entra ClientId (encrypted)",
  "PolicyType": "SettingsUpdate",
  "Status": "enforce",
  "Extension": {
    "Action": "Update",
    "SecureSettings": {
      "UserGroupResolver:ClientId": "<your Application (client) ID from Part 1>"
    }
  }
}
```

#### Full Policy Example

{% code overflow="wrap" %}

```
{
	"PolicyName": "Assign Azure Client ID",
	"PolicyType": "SettingsUpdate",
	"PolicyId": "AdCKQ7svb7yvsvWH5QYKgg",
	"Status": "enforce",
	"Actions": {
		"OnSuccess": {
			"Controls": []
		},
		"OnFailure": {
			"Command": ""
		}
	},
	"NotificationMessage": "A policy has been set to monitor mode.  When this policy is enabled, [mfa, justification, request] will be required to run this process as an administrator.",
	"NotificationRequiresAcknowledge": false,
	"RiskLevel": 50,
	"Operator": "And",
	"Rules": [
		{
			"RuleName": "UserCheck",
			"ErrorMessage": "This user is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckUser()"
		},
		{
			"RuleName": "MachineCheck",
			"ErrorMessage": "This Machine is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckMachine()"
		},
		{
			"RuleName": "ApplicationCheck",
			"ErrorMessage": "This application is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckFile(false)"
		},
		{
			"RuleName": "DateCheck",
			"ErrorMessage": "Current date is not covered by this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckDate()"
		},
		{
			"RuleName": "TimeCheck",
			"ErrorMessage": "Current time is not covered by this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckTime()"
		},
		{
			"RuleName": "DayCheck",
			"ErrorMessage": "Today is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckDay()"
		},
		{
			"RuleName": "CertificateCheck",
			"ErrorMessage": "Certificate hash is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckCertificate()"
		}
	],
	"UserCheck": [
		"*"
	],
	"MachineCheck": [
		"*"
	],
	"ApplicationCheck": [
		"*"
	],
	"DayCheck": [],
	"DateCheck": [],
	"TimeCheck": [],
	"CertificationCheck": [],
	"Extension": {
		"Action": "Update",
		"SecureSettings": {
			"UserGroupResolver:ClientId": "<your Application (client) ID from Part 1>"
		}
	}
}
```

{% endcode %}

* The policy status is **enforce**.
* The value is the Application (client) ID, not the object ID or directory (tenant) ID.
* The value is stored under `SecureSettings`; do not distribute a client secret.
  {% endstep %}

{% step %}

### Validate Policy Matching

### Add the Group Directly to Privilege Elevation Policy <a href="#test-heading" id="test-heading"></a>

Create or edit a Privilege Elevation policy, add the Entra group as a group filter **directly** (not as a collection), and test the policy with any control.

{% hint style="success" %}

#### Expected: control passes

The group membership resolves and the Privilege Elevation policy is enforced.
{% endhint %}
{% endstep %}

{% step %}

### Reproduce the Collection Issue

### Add the Group through a Group Collection <a href="#results-heading" id="results-heading"></a>

Repeat the test, but add the same Entra group through a group collection instead of adding the group directly to the Privilege Elevation policy.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FgWFwKmkfS4VoRNUwDwOE%2Fimage.png?alt=media&amp;token=622d5039-bacd-41df-a5b5-5c0db2dd2348" alt=""><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

{% columns %}
{% column %}

#### Direct Group Filter

Control passes and the Privilege Elevation policy is applied.
{% endcolumn %}

{% column %}

#### Group Collection Filter

Control fails with `EnforcementDisabled`; native UAC appears instead.
{% endcolumn %}
{% endcolumns %}

{% hint style="info" %}
If the direct-group test passes but the collection test returns `EnforcementDisabled`, the endpoint is reproducing the Azure AD group collection filter issue described on this page. Confirm the client ID policy and collect endpoint logs before escalating.
{% endhint %}

***

## Troubleshooting

Example of Command Prompt for Troubleshooting

{% code overflow="wrap" %}

```
C:\Users\JohnDoe>"C:\Program Files\Keeper Security\Endpoint Privilege Manager\Jobs\bin\UserGroupResolver\UserGroupResolver.exe" --dry-run --client-id <your Application (client) ID from Part 1>
```

{% endcode %}

Example of Successful Response

{% code overflow="wrap" %}

```
{
    "userSid": "S-1-12-1-1230035805-203337995-2932204708-3501512273",
    "userName": "AzureAD\\JohnDoe",
    "windowsStatus": "Ok",
    "entraStatus": "Ok",
    "local": [
        {
            "name": "Remote Desktop Users",
            "sid": "S-1-5-32-555"
        },
        {
            "name": "Users",
            "sid": "S-1-5-32-545"
        }
    ],
    "ad": [],
    "azure": [
        {
            "sid": "S-1-12-1-3835191376-1160143123-1997930151-2855338395",
            "domain": "AzureAD",
            "id": "e4986050-6113-4526-a7fe-15779b0131aa"
        },
        {
            "sid": "S-1-12-1-3739764121-1102381688-1139556528-502970863",
            "domain": "AzureAD",
            "id": "dee84599-0278-41b5-b040-ec43efb9fa1d"
        }
    ]
}
```

{% endcode %}

***

## Related Pages

* [Privilege Elevation Policy](/keeperpam/endpoint-privilege-manager/policies/policy-types/privilege-elevation-policy-type.md)
* [Policy Evaluation](/keeperpam/endpoint-privilege-manager/policies/policy-reference/policy-evaluation.md)
* [Reference Targeting](/keeperpam/endpoint-privilege-manager/collections/reference-targeting.md)
* [Configuration Settings](/keeperpam/endpoint-privilege-manager/architecture/configuration-settings.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.keeper.io/keeperpam/endpoint-privilege-manager/policies/policy-reference/policy-evaluation/setup-entra-id-group-filters-in-privilege-elevation-policies.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.