Syncing Specific Entra ID Groups to Cloud Identity Engine

A.Rodrigo — Fri, 26 Dec 2025 09:58:11 GMT

We are planning to integrate CIE with Entra ID to map and authenticate GlobalProtect users. However, after completing the configuration, we observed that all users from Entra ID were synced to the CIE side, even though a filter was configured to include only users from a specific group.

Could someone please assist us in understanding why this is happening and how we can ensure that only the intended users are synced? Your help would be highly appreciated.

Thank you

Re: Syncing Specific Entra ID Groups to Cloud Identity Engine

arusharma — Wed, 21 Jan 2026 04:08:49 GMT

Use Entra ID Group-Based Access Control (Recommended)
Create a dedicated Entra ID group for GlobalProtect users
Assign only intended users to this group

This can only be controlled from EntraID side.

topic Syncing Specific Entra ID Groups to Cloud Identity Engine in GlobalProtect Discussions

Syncing Specific Entra ID Groups to Cloud Identity Engine

Re: Syncing Specific Entra ID Groups to Cloud Identity Engine