Security

Hi all, 

I am trying to fetch group membership info from Entra ID to assign the user to correct role/Vlan. I have followed the posts on airheads but still i am stuck on not getting any authz attributes from Entra ID. Below is all the information i have 

1) ClearPass 6.12.0 (no patch installed)

2) User is able to authenticate using EAP-TLS successfully. snap is also attached.

3) I used python to check tenant ID, client ID, secret etc to make sure i am getting the correct group info etc from ENtra ID

4) In Clearpass test connection in ENTRA ID is successful

5) below is my filter query

users:users/?$select=mail,userPrincipalName,id,department,accountEnabled&$filter=userPrincipalName eq %{Authentication:Username};group:/users/%{users:id}/memberOf?$select=displayName

6) Below are snapshot of my service

 i have made the rolemappings because i read in airheads that its required to fetch the details from entra id, but in my case i am not getting authorization attributes in access tracker.

can someone guide me what am i doing wrong?

-------------------------------------------

I test this for you in 5 minutes and it worked with ClearPass 6.12.3. Beter not use the first major release of 6.12.0 but patch it to the latest 6.12.x version the .0 version often has many bugs.

You can follow this guide

Microsoft Entra ID

• Did you set the API permissions correct in Entra ID? 
• Did you test with the Authentication Source test button?
• Did you first test with the default filter query?
• First check if you see the Authorization in the Access Tracker input before configure then in your role mapping

My result example:

users:users/?$select=userPrincipalName,displayName,id,accountEnabled,companyName,createdDateTime,department,employeeId,lastPasswordChangeDateTime,registeredDevices&$filter=mail eq %{Authentication:Username};group:/users/%{users:id}/memberOf?$select=displayName,id,groupTypes

Let me know if you get solved is, config it self seems fine to me.

------------------------------
Marcel Koedijk | MVP Expert 2024 | ACEP | ACMP | ACCP | ACDP | Ekahau ECSE | Not an HPE Employee | Opinions are my own

Original Message:
Sent: Jan 07, 2026 09:24 AM
From: harry fine
Subject: Cannot get authorization attributes from Entra id - CPPM 6.12.0

Hi all, 

I am trying to fetch group membership info from Entra ID to assign the user to correct role/Vlan. I have followed the posts on airheads but still i am stuck on not getting any authz attributes from Entra ID. Below is all the information i have 

1) ClearPass 6.12.0 (no patch installed)

2) User is able to authenticate using EAP-TLS successfully. snap is also attached.

3) I used python to check tenant ID, client ID, secret etc to make sure i am getting the correct group info etc from ENtra ID

4) In Clearpass test connection in ENTRA ID is successful

5) below is my filter query

users:users/?$select=mail,userPrincipalName,id,department,accountEnabled&$filter=userPrincipalName eq %{Authentication:Username};group:/users/%{users:id}/memberOf?$select=displayName

6) Below are snapshot of my service

 i have made the rolemappings because i read in airheads that its required to fetch the details from entra id, but in my case i am not getting authorization attributes in access tracker.

can someone guide me what am i doing wrong?

-------------------------------------------

I think your filter is incorrect.

users:users/?$select=userPrincipalName,displayName,id,accountEnabled,companyName,createdDateTime,department,employeeId,lastPasswordChangeDateTime,registeredDevices&$filter=mail eq %{Authentication:Username};group:/users/%{users:id}/memberOf?$select=displayName,id,groupTypes

------------------------------
Marcel Koedijk | MVP Expert 2024 | ACEP | ACMP | ACCP | ACDP | Ekahau ECSE | Not an HPE Employee | Opinions are my own

Original Message:
Sent: Jan 07, 2026 12:34 PM
From: mkk
Subject: Cannot get authorization attributes from Entra id - CPPM 6.12.0

I test this for you in 5 minutes and it worked with ClearPass 6.12.3. Beter not use the first major release of 6.12.0 but patch it to the latest 6.12.x version the .0 version often has many bugs.

You can follow this guide

Microsoft Entra ID

• Did you set the API permissions correct in Entra ID? 
• Did you test with the Authentication Source test button?
• Did you first test with the default filter query?
• First check if you see the Authorization in the Access Tracker input before configure then in your role mapping

My result example:

users:users/?$select=userPrincipalName,displayName,id,accountEnabled,companyName,createdDateTime,department,employeeId,lastPasswordChangeDateTime,registeredDevices&$filter=mail eq %{Authentication:Username};group:/users/%{users:id}/memberOf?$select=displayName,id,groupTypes

Let me know if you get solved is, config it self seems fine to me.

------------------------------
Marcel Koedijk | MVP Expert 2024 | ACEP | ACMP | ACCP | ACDP | Ekahau ECSE | Not an HPE Employee | Opinions are my own

Original Message:
Sent: Jan 07, 2026 09:24 AM
From: harry fine
Subject: Cannot get authorization attributes from Entra id - CPPM 6.12.0

Hi all, 

I am trying to fetch group membership info from Entra ID to assign the user to correct role/Vlan. I have followed the posts on airheads but still i am stuck on not getting any authz attributes from Entra ID. Below is all the information i have 

1) ClearPass 6.12.0 (no patch installed)

2) User is able to authenticate using EAP-TLS successfully. snap is also attached.

3) I used python to check tenant ID, client ID, secret etc to make sure i am getting the correct group info etc from ENtra ID

4) In Clearpass test connection in ENTRA ID is successful

5) below is my filter query

users:users/?$select=mail,userPrincipalName,id,department,accountEnabled&$filter=userPrincipalName eq %{Authentication:Username};group:/users/%{users:id}/memberOf?$select=displayName

6) Below are snapshot of my service

 i have made the rolemappings because i read in airheads that its required to fetch the details from entra id, but in my case i am not getting authorization attributes in access tracker.

can someone guide me what am i doing wrong?

-------------------------------------------

Dear Marcel, 

After spending hours i found the problem and solution. Now its working fine on 6.12.0. I had to replace mail to userPrincipalName in the filter. Rest all is ok, i even removed Rolemapping policy and it worked. I did a complete fresh installation again and everything worked just fine. So "mail" was the culprit in my case

default filter

users:users/?$select=userPrincipalName,displayName,id,accountEnabled,companyName,createdDateTime,department,employeeId,lastPasswordChangeDateTime,registeredDevices&$filter=mail eq %{Authentication:Username};group:/users/%{users:id}/memberOf?$select=displayName,id,groupTypes

Correct query (in my case)

users:users/?$select=userPrincipalName,displayName,id,accountEnabled,companyName,createdDateTime,department,employeeId,lastPasswordChangeDateTime,registeredDevices&$filter=userPrincipalName eq %{Authentication:Username};group:/users/%{users:id}/memberOf?$select=displayName,id,groupTypes

Rest everything is same, as i mentioned in my post, i tested the connection from clearpass as well as from a python script and got everything as expected. 

Can you tell me how to write the filters? is there any guide because honestly i dont know how to relate the attribute names/alias to the filter query

Original Message:
Sent: Jan 07, 2026 12:50 PM
From: mkk
Subject: Cannot get authorization attributes from Entra id - CPPM 6.12.0

I think your filter is incorrect.

users:users/?$select=userPrincipalName,displayName,id,accountEnabled,companyName,createdDateTime,department,employeeId,lastPasswordChangeDateTime,registeredDevices&$filter=mail eq %{Authentication:Username};group:/users/%{users:id}/memberOf?$select=displayName,id,groupTypes

------------------------------
Marcel Koedijk | MVP Expert 2024 | ACEP | ACMP | ACCP | ACDP | Ekahau ECSE | Not an HPE Employee | Opinions are my own

Original Message:
Sent: Jan 07, 2026 12:34 PM
From: mkk
Subject: Cannot get authorization attributes from Entra id - CPPM 6.12.0

I test this for you in 5 minutes and it worked with ClearPass 6.12.3. Beter not use the first major release of 6.12.0 but patch it to the latest 6.12.x version the .0 version often has many bugs.

You can follow this guide

Microsoft Entra ID

• Did you set the API permissions correct in Entra ID? 
• Did you test with the Authentication Source test button?
• Did you first test with the default filter query?
• First check if you see the Authorization in the Access Tracker input before configure then in your role mapping

My result example:

users:users/?$select=userPrincipalName,displayName,id,accountEnabled,companyName,createdDateTime,department,employeeId,lastPasswordChangeDateTime,registeredDevices&$filter=mail eq %{Authentication:Username};group:/users/%{users:id}/memberOf?$select=displayName,id,groupTypes

Let me know if you get solved is, config it self seems fine to me.

------------------------------
Marcel Koedijk | MVP Expert 2024 | ACEP | ACMP | ACCP | ACDP | Ekahau ECSE | Not an HPE Employee | Opinions are my own

Original Message:
Sent: Jan 07, 2026 09:24 AM
From: harry fine
Subject: Cannot get authorization attributes from Entra id - CPPM 6.12.0

Hi all, 

I am trying to fetch group membership info from Entra ID to assign the user to correct role/Vlan. I have followed the posts on airheads but still i am stuck on not getting any authz attributes from Entra ID. Below is all the information i have 

1) ClearPass 6.12.0 (no patch installed)

2) User is able to authenticate using EAP-TLS successfully. snap is also attached.

3) I used python to check tenant ID, client ID, secret etc to make sure i am getting the correct group info etc from ENtra ID

4) In Clearpass test connection in ENTRA ID is successful

5) below is my filter query

users:users/?$select=mail,userPrincipalName,id,department,accountEnabled&$filter=userPrincipalName eq %{Authentication:Username};group:/users/%{users:id}/memberOf?$select=displayName

6) Below are snapshot of my service

 i have made the rolemappings because i read in airheads that its required to fetch the details from entra id, but in my case i am not getting authorization attributes in access tracker.

can someone guide me what am i doing wrong?

-------------------------------------------

Hi all, 

I am trying to fetch group membership info from Entra ID to assign the user to correct role/Vlan. I have followed the posts on airheads but still i am stuck on not getting any authz attributes from Entra ID. Below is all the information i have 

1) ClearPass 6.12.0 (no patch installed)

2) User is able to authenticate using EAP-TLS successfully. snap is also attached.

3) I used python to check tenant ID, client ID, secret etc to make sure i am getting the correct group info etc from ENtra ID

4) In Clearpass test connection in ENTRA ID is successful

5) below is my filter query

users:users/?$select=mail,userPrincipalName,id,department,accountEnabled&$filter=userPrincipalName eq %{Authentication:Username};group:/users/%{users:id}/memberOf?$select=displayName

6) Below are snapshot of my service

 i have made the rolemappings because i read in airheads that its required to fetch the details from entra id, but in my case i am not getting authorization attributes in access tracker.

can someone guide me what am i doing wrong?

Hi all, 

I am trying to fetch group membership info from Entra ID to assign the user to correct role/Vlan. I have followed the posts on airheads but still i am stuck on not getting any authz attributes from Entra ID. Below is all the information i have 

1) ClearPass 6.12.0 (no patch installed)

2) User is able to authenticate using EAP-TLS successfully. snap is also attached.

3) I used python to check tenant ID, client ID, secret etc to make sure i am getting the correct group info etc from ENtra ID

4) In Clearpass test connection in ENTRA ID is successful

5) below is my filter query

users:users/?$select=mail,userPrincipalName,id,department,accountEnabled&$filter=userPrincipalName eq %{Authentication:Username};group:/users/%{users:id}/memberOf?$select=displayName

6) Below are snapshot of my service

 i have made the rolemappings because i read in airheads that its required to fetch the details from entra id, but in my case i am not getting authorization attributes in access tracker.

can someone guide me what am i doing wrong?

I'm curious as to why you're attempting to do this with an unpatched version of ClearPass?

Hi all, 

I am trying to fetch group membership info from Entra ID to assign the user to correct role/Vlan. I have followed the posts on airheads but still i am stuck on not getting any authz attributes from Entra ID. Below is all the information i have 

1) ClearPass 6.12.0 (no patch installed)

2) User is able to authenticate using EAP-TLS successfully. snap is also attached.

3) I used python to check tenant ID, client ID, secret etc to make sure i am getting the correct group info etc from ENtra ID

4) In Clearpass test connection in ENTRA ID is successful

5) below is my filter query

users:users/?$select=mail,userPrincipalName,id,department,accountEnabled&$filter=userPrincipalName eq %{Authentication:Username};group:/users/%{users:id}/memberOf?$select=displayName

6) Below are snapshot of my service

 i have made the rolemappings because i read in airheads that its required to fetch the details from entra id, but in my case i am not getting authorization attributes in access tracker.

can someone guide me what am i doing wrong?

Dear Carson, 

Thank you for coming in. I was testing in my lab and honestly the patch installation takes a lot of time, not sure why that is but i have been doing it since 6.7, and patch installation takes lot of time. For Demo/PoC in most cases i am ok with default versions. Thats why i tried without latest patch. 

I'm curious as to why you're attempting to do this with an unpatched version of ClearPass?

Hi all, 

I am trying to fetch group membership info from Entra ID to assign the user to correct role/Vlan. I have followed the posts on airheads but still i am stuck on not getting any authz attributes from Entra ID. Below is all the information i have 

1) ClearPass 6.12.0 (no patch installed)

2) User is able to authenticate using EAP-TLS successfully. snap is also attached.

3) I used python to check tenant ID, client ID, secret etc to make sure i am getting the correct group info etc from ENtra ID

4) In Clearpass test connection in ENTRA ID is successful

5) below is my filter query

users:users/?$select=mail,userPrincipalName,id,department,accountEnabled&$filter=userPrincipalName eq %{Authentication:Username};group:/users/%{users:id}/memberOf?$select=displayName

6) Below are snapshot of my service

 i have made the rolemappings because i read in airheads that its required to fetch the details from entra id, but in my case i am not getting authorization attributes in access tracker.

can someone guide me what am i doing wrong?