help stuck on using azure ad groups in my access role policy

[nflnetwork29]

this policy is being used for remote access vpn / azure ad / saml / sso / identity provider.

my connections are working

my traffic is hitting the cleanup rule

i create 1 vpn policy and have configured an azure security group as the source for this policy - it's not being matched

im stuck - any help is appreciated

mgmt is R81.10

why is it not being matched????

My smart console can see all my azure objects - no issue there

thanks,