...
GEN7-38743
Content Filtering Service (CFS) policies based on AD Groups do not work when using TSA agent for SSO authentication.