CIE group (created on EntraID and Okta) visible in CIE but not recognized by PAN-OS firewall

Meed — Tue, 15 Sep 2026 16:44:00 GMT

Hi everyone,

I’m troubleshooting a CIE group mapping issue on a firewall and would appreciate some advice.

The setup is:

6 existing groups from the same CIE directory work correctly. However, newly created groups are not recognized by the firewall.

I tested 2 different cases:

In both cases:

The group is visible in the CIE directory.
The group has members.
The group is added to the GP Portal Agent Config.
The group is addded to the Gateway configuration.
The group is also referenced in a Security Policy (suggestion of our PA support)
The pushed configuration contains the correct group name and domain separator.
I manually forced a CIE refresh.

The direct lookup fails: show user group name "cie-domain\GP-Ring1"

Result: User group 'cie-domain\GP-Ring1' does not exist or does not have members

The CIE sync status itself reports success, and 6 other groups (created on Okta or Entra) from the same directory are available on the firewall.

At this point, I’m trying to understand whether:

CIE groups are only retrieved under specific conditions
the group must be associated with an authenticated user before it appears
there is a cache or refresh issue on the firewall ??
a particular CIE or PAN-OS command is required to request the group explicitly ??
An known issue with 11.1.13

Has anyone seen this behavior with CIE and Okta, especially when Okta itself receives groups from both Entra ID and its own directory?

Thanks !!

topic CIE group (created on EntraID and Okta) visible in CIE but not recognized by PAN-OS firewall in Cloud Identity Engine Discussions