Entra ID - Security Groups: "Users to Machines" Filter Does Not Match Primary User to a Machine

Products

IT Management Suite Client Management Suite Server Management Suite

Issue/Introduction

When using Active Directory (AD) or Entra ID Security Groups, filters using the Users to Machines rule fail to include computers mapped to their primary user in hybrid environments (where Active Directory is synchronized with Entra ID).

Even though user records merge as expected based on their unique Directory ID, the system fails to match the primary user to their assigned endpoint, leaving target machine filters incomplete or empty.

Environment

IT Management Suite (ITMS) 8.8 / 8.8.1

Directory Services / Active Directory Import / Entra ID Integration

Hybrid Mode (Active Directory synchronized with Entra ID / Azure Tenant)

Cause

In a hybrid deployment (on-premises Active Directory synced with Entra ID), the Symantec Management Platform (SMP) successfully merges user accounts into a single database resource using the user's directoryid. However, the filter query attempts to match endpoint computers against the AeX AC Primary User data class, which relies on standard name.domain entries.

When users sync with Entra ID, naming formats transition or conflict with local domain formats (e.g., changing to AzureAD\User or User Principal Name format). Because the existing queries only check name.domain strings rather than fully merged identity keys, the query fails to resolve primary user ownership for the machine.

The filter resolution query evaluates primary user records strictly using standard name.domain string entries stored in the AeX AC Primary User data class. While user resources successfully merge duplicate accounts via directoryid, the SQL stored procedures and views used by Active Directory Connector did not query the fully merged identity keys. As a result, endpoints reported via Symantec Management Agent (SMA) basic inventory cannot be matched to the user's updated Entra ID identity.

Resolution

This issue has been fixed with our ITMS 8.8.2 release.

A pointfix is available with our CUMULATIVE POST ITMS 8.8.1 POINT FIXES (SMA_SMP_8_8_1_PF_v7 or later)

Step 1: Diagnose and Verify Data Sources

Before applying the fix, verify that the Symantec Management Agent on the endpoint is sending the expected primary user inventory data and that the user resource key is properly merged in the database.

Check SMA Basic Inventory Log Output:
Inspect the basic inventory sent by the client to confirm the AeX AC Primary User data class is populated (see "Trapping NSEs on a Windows client" on how to capture the basic inventory NSE):

Example entry:

<dataClass name="AeX AC Primary User">
    <data>
        <resource partialUpdate="false" resourceRef="1">
            <row c1="May" c2="UO12345" c3="EXAMPLE" c5="2026"/>
        </resource>
    </data>
</dataClass>

Verify Database User Resource Keys:
Run the following query on the Symantec Management Platform database (Symantec_CMDB) to confirm that user identities are merged via directoryid:

SELECT ResourceGuid, KeyName, Value 
FROM ResourceKey 
WHERE ResourceGuid = '59B699EA-5C41-41F4-9658-B23D63DD76B3' -- Replace with target User GUID

Expected Diagnostic Output:

ResourceGuid	KeyName	Value
`59b699ea-5c41-41f4-9658-b23d63dd76b3`	`cloudid`	`E64############C9D9`
`59b699ea-5c41-41f4-9658-b23d63dd76b3`	`directoryid`	`8B#############CE825`
`59b699ea-5c41-41f4-9658-b23d63dd76b3`	`distinguishedname`	`CN=USER ONE,OU=DEFAULT USERS,OU=EXAMPLE HQ,DC=EXAMPLE1,DC=LAN`
`59b699ea-5c41-41f4-9658-b23d63dd76b3`	`name.domain`	`[email protected]`
`59b699ea-5c41-41f4-9658-b23d63dd76b3`	`name.domain`	`UO12345.EXAMPLE`

Step 2: Apply the PointFix (PF) Components

Install the updated fix files in CUMULATIVE POST ITMS 8.8.1 POINT FIXES (SMA_SMP_8_8_1_PF_v7 or later)

Step 3: Run Active Directory and Entra ID Import Rules

Open the SMP Console.
Navigate to Actions > Import > Import Microsoft Active Directory.
Select your AD Users import rule.
Ensure the option Match computers with primary users is enabled.
Click Run now to execute the Active Directory Users Import rule.
Execute your Azure / Entra ID Users Import rule (under Settings > Notification Server > Cloud Authentication > Cloud Active Directory Import).

Step 4: Verification of Resolution

On the SMP Console, navigate to Manage > Filters.
Locate the affected computer filter.
Verify that usernames display using the AzureAD\ prefix format (e.g., AzureAD\User).
Confirm that client endpoints reported via basic inventory (or assigned manually) now correctly appear in the filter membership list.