GlobalProtect Name Normalization issue

B.Sanchez392701 — Thu, 05 Feb 2026 21:25:25 GMT

Hello, I have set up GlobalProtect using AZURE SSO for the sign in and for group mapping I am using LDAP. However, in the GPSVC logs, I see users being returned as domain\\username
2 slashes. This is causing issues with users not being able to get a client config as I am putting users in specific subnets according to their AD membership.

The username attribute on the azure side is set to return
Join (user.netbiosname, "\", user.onpremisessamaccountname).
I have done this as the userid is expecting users to be returned as domain\username.

I confirmed in authd log and in the globalprotect client logs that there is only a single slash being returned by Azure. I am not sure where this extra slash is coming in from.

I have also confirmed in the auth profile looks fine.
I have a similar set up on a different firewall for GlobalProtect and that seems to be working fine.

What am I missing in the settings that is causing this extra slash? I attached the screenshot showing the attrib and claims setting from Azure/

Re: GlobalProtect Name Normalization issue

TomYoung — Tue, 10 Feb 2026 21:16:30 GMT

Hi @B.Sanchez392701 ,

I also use Entra SSO for GP and LDAP for group mapping. I made no changes to the username attribute on the Azure side. Under Monitor > Logs > User-ID, the USER PROVIDED BY SOURCE shows name@domain.com. Under Device > User Identification > Group Mapping Settings > [edit mapping] > Server Profile > Domain Setting > User Domain I added the NetBIOS domain name with no \ or @. This configuration normalizes the username format to domain\user. Going back to Monitor > Logs > User-ID, the USER field shows domain\user even though the USER PROVIDED BY SOURCE shows name@domain.com. That is all I had to do to get my GP users to match the LDAP groups.

Thanks,

Tom

topic Re: GlobalProtect Name Normalization issue in GlobalProtect Discussions

GlobalProtect Name Normalization issue

Re: GlobalProtect Name Normalization issue