User not matched to Entra ID Access Roles when part of more than 100 Entra ID groups

Product: Identity Awareness
Version: R81.10 (EOS), R81.20, R82
Last Modified: 2025-12-29

Symptoms

• Users who authenticate themselves using Entra ID cannot access resources behind an Identity Awareness Gateway, even though the users have the necessary Access Roles.
• In Entra ID, the user is a member of more than 100 groups.
• On the Identity Awareness Gateway, the users are defined in nested groups.
• On the Identity Awareness Gateway, the users do not get all of the access roles that are associated with the nested groups.

Cause

Identity Awareness considers only the user's first 100 groups in Entra ID.

Solution

For R81.10 and R81.20:

This problem was fixed. The fix is included starting from:

• Jumbo Hotfix Accumulator for R82 starting from Take 60
• Jumbo Hotfix Accumulator for R81.20 starting from Take 90
• Jumbo Hotfix Accumulator for R81.10 starting from Take 173

Check Point recommends to always upgrade to the Recommended version ( Security Gateway / VSX / Security Management Server / Multi-Domain Security Management Server / SmartConsole).

If you choose not to upgrade, contact Check Point Support to get a Hotfix for your version.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.

For faster resolution and verification, collect these files:

1. CPinfo file from the Management Server involved in the case.
2. CPinfo file from the Security Gateway / each Cluster Member involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

For R82:

Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.

For faster resolution and verification, collect these files:

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General
Status: Approved by TAC
Date Created: 2025-04-21
Last Modified: 2025-12-29