Global Protect portal Config selection criteria combination of User group/device check/custom check?

[Sec101]

I'm guessing others are combining these together, but is it possible to specify these together mix/match?    Specifically, We have configs without a custom check (custom checkmark box UNchecked-portal/agent/configs/config selection criteria custom checks), and that are only based on AD group. But when I turn on custom checks for a different agent config that includes both AD group and Custom Check (portal/agent/config/config selection criteria/custom checks) , the configs with only an AD group specified (and NO custom checks) don't match.  Almost like once you turn on Custom checks in one config, the portal uses that against all other agent configs regardless of if that "custom checks" box is marked or not.

This is all on the same portal.  

[BPry]

@Sec101,

Are you attempting to utilize the same group in both agent configurations? 

[Sec101]

different groups even.   It's kind of like it prioritizes the registry custom check for every agent config you have, and starts to check that first before checking your AD group. 

This actually seems to be related to using different auth profiles.   I can't replicate when using the same auth profile (simple ldap).   When getting a username back from SAML (we are sending back domain\username) it's failing to match any config -  but it only fails when I select the "custom check" to match against reg key.  If I remove that check, everything works normally.   Odd that I can cause a failure, simply by editing that box.  It's like it's changing the way that the portal looks at the username and domain?