maybe good idea to check the permissions and to clarify some things. Pls. have a look into your Entra Portal, and get the Device ID and Object ID of one Device that's member of one or more Groups i.e.
then fill your data into this script. Tennant ID / Client ID (Thats the App ID from Entry ID ) Like this : 
the Client Secret you will get only once when creating the APP Registration, or when creating a new Client Secret. Fill into the following Powershell Script, and run the Script.
# 🔍 Replace with your specific device ID (This is a "ENTRA DEVICE OBJECT ID" not a Device ID from device Properties in Entra !!!)
$ObjectId = "XXyout data XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX"
# Define credentials and endpoints
$tenantId = "your-tenant-id"
$clientId = "your-client-id"
$clientSecret = "your-client-secret"
$scope = "https://graph.microsoft.com/.default"
$tokenUrl = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token"
# Get access token
$Body = @{
client_id = $clientId
scope = $scope
client_secret = $clientSecret
grant_type = "client_credentials"
}
$tokenResponse = Invoke-RestMethod -Method Post -Uri $tokenUrl -Body $Body
$accessToken = $tokenResponse.access_token
$headers = @{
"Authorization" = "Bearer $accessToken"
"Content-Type" = "application/json"
}
# Get group memberships for the device
$Uri = "https://graph.microsoft.com/v1.0/devices/" + $ObjectId
$EntraObj = Invoke-RestMethod -Uri $uri -Headers $headers
Write-host ("Display Name : ", $EntraObj.displayName) -ForegroundColor Green
Write-host ("Obj ID : ", $EntraObj.id )-ForegroundColor Green
Write-host ("Display Name : ",$EntraObj.deviceId) -ForegroundColor Green
$Uri = "https://graph.microsoft.com/v1.0/devices/" + $ObjectId + "/memberOf"
$groupMemberships = Invoke-RestMethod -Uri $uri -Headers $headers
# Display results
foreach ($group in $groupMemberships.value) {
Write-Host "Group: $($group.displayName) [$($group.id)]"
}
If your Tenannt ID / Device ID / App ID and Client Secret, and permissions are ok you will get a response like this: 
if you get this, you have to dig deeper into Clearpass, if you do not get this output you have a problem in Entra or variables. This Script ist just to check if settings / Permission in Entra are correct. Just to point into a direction to look, and to check Permissions and Variables.
Original Message:
Sent: Jun 25, 2025 03:07 AM
From: kmich
Subject: Clearpass not getting group membership from EntraID
We have a customer where we are installing CPPM 6.12. Customer will use both Microsoft AD and Entra. The reason is that they are migrating from AD to Entra and this will take a while. So, we need to support both. Also, customer concluded that they want to have only device authentication and not user, for the company PCs, using certificates and EAP-TLS on CPPM side. They also have Intune where all devices are registered (company PCs and company mobile phones). We have configured the authentication and authorization sources, the role mappings, the enforcement policy and the service. We are trying to get the group membership info for the device in order to assign the required profile.
The customer adjusted their profile in SCEP to produce the proper certificate with the necessary attributes.
So, now we are getting the Certificate:Subject-L attribute in the access tracker.
Our Authorization source is like following and the connection test is successful:
Based on the filter used above, we would expect the information regarding the group membership of the device to be seen, possibly in the Access Tracker, under the authorization attributes. However, we can't see anything related to Entra authorization source attributes from the device. We have a test PC which belongs to the group called "CPPM-Admin-Devices".
In the Access Tracker, you can see the Authorization sources configured, which includes the Entra but on the Authorization Attributes section, there is nothing coming back from that authorization source.
Any ideas on what we are missing? The important is to get the group membership info for each device.
Thanks in advance