Dynamic group membership is not evalued correctly by the CA Beta endpoint and GUI Whatif New experience mode

[milanschwartz]

Merril,

I have two policies. Policy B is evaluated correctly on GUI Whatif (new experinence) and Beta evaluation endpoint. Policy A shows "Not enough Information" as the reason why it is not applied.

Policy A: fails evaluation
Include group: DynamicGroupA
ClientAppType: browser
Include cloud app: App A
Grant control: MFA

Policy B: evaluated correctly
Include: All users
ClientAppType: browser
Include cloud app: App A
Grant control: SigninFrequency

I set up the evaluation by using a member of DynamicGroupA, client app type as browser, target app as App A.

Side note: Classic GUI Whatif evaluates both policies properly.

Can you please communicate this issue with the product team?

[milanschwartz]

I see the same behaviour if the policy contains directory role condition. Beta eval endpoint and new what if experience fail to find policies that apply, old what if tool does find them with same input.

[merill]

Thanks for reporting. Since this is not related to Maester, I'll move this to a discussion and share internally,

[milanschwartz]

Thank you Merril. I have also opened a support ticket with Microsoft. I suggest maybe to consider adding the information to Maester documentation on the https://maester.dev/docs/ca-what-if page as the test will return incomplete results in at least the above scenarios.