This message was deleted.

Also when I trace aaad.debug I see the security group is found during the LDAP group extract for all of us. But they still don't get printers and I do. Our LDAP connect/extract essentially looks identical. Finally I've pulled the IP.SRC piece out to make sure it's the AAA.USER.IS_MEMBER_OF that's not working right, and I've confirmed this. So it seems like the ICA policy doesn't think they are in the group even though aaad.debug shows they are. Any thoughts?