SAML Azure AD - Remote access Access Role policy

[Refaeliko]

Hey,

I have a problem now on implementation when using SAML Azure AD authentication. Everything is working - authentication etc. Users can login properly - connectivity is ok. 

The problem is that from the moment I added groups to the cp application in azure, even if there is no rule - the authorized users have access to all the networks. If they are restricted by a certain rule they still have access to all the networks, and the rule not working. Does anyone have an idea?

Thanks to those who answered! 

[the_rock]

Can you maybe send some screenshots of the rule in question, as well as groups referenced and the log showing that access? I think that would help us...please blur out any sensitive info.

Best,

Andy

[Refaeliko]

This is exactly the point that the rule has no effect on the Azure users. Even if there is no rule on the azure users - all networks are open for these users. Even if there is a rule that blocks it, everything is still open. On the other hand, Legacy users work according to the rules. There was one case that stopped the access and it was that I created a rule that blocks 'all users' and then everything was blocked.

If the screenshots are still important to you - I will send them.

[PhoneBoy]

You've created the necessary groups in SmartConsole, correct?
https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_RemoteAccessVPN_AdminGuide/T... 
You've added those groups to the relevant Access Role objects, correct?

[Refaeliko]

Of course