topic Re: windows identity agent with entra groups for authorization in General Topics

windows identity agent with entra groups for authorization

dave_vz — Fri, 25 Sep 2026 08:24:37 GMT

i have a question.

we are using identity agent on windows with sso towards the ad domain.

this works ok.

we can create access roles that reference ad groups and this also works

we are also using entra.

i would like to know if i can mix them together

so get the identity of the user via the identity agent on the pc (this works)

and match this with a entra group to deliver the authorization.

i configured entra with succes, but in my testing i see no match happening between this combination

Re: windows identity agent with entra groups for authorization

PhoneBoy — Fri, 25 Sep 2026 19:03:36 GMT

Groups in LDAP (for on-premise AD) versus groups in SAML (i.e. Entra ID) are handled and represented differently.
As a result, there is no way to correlate between the two.

Entra ID groups (passed to the gateway via the SAML assertion) can be used in policies, but they must be explicitly defined.
See: https://support.checkpoint.com/results/sk/sk177267

Having said that, @Royi_Priov is this something that Identity and Trust allows for?

Re: windows identity agent with entra groups for authorization

Royi_Priov — Wed, 30 Sep 2026 05:32:46 GMT

Thanks for tagging me.

Hi @dave_vz ,

An alternative solution would be Identity and Trust.

It leverages already existing clients such as Microsoft Intune, Microsoft Defender, CrowdStrike Falcon, and also Check Point products such as SASE, Workforce AI, Endpoint, and Browser security. We fully support Entra ID and also other IDPs.

If you want to get more information, feel free to DM / tag me