BigFix 11.0.7: Entra ID Properties Showing N/A Despite Successful Microsoft Graph Authentication

1

Hi everyone,

After upgrading our environment to BigFix 11.0.7, we're having trouble getting the new User-Based Management properties populated from Microsoft Entra ID.

Environment

  • Root Server: 11.0.7.64 (Windows Server 2019)

  • Clients: 11.0.7.61

  • Approximately 6,000 endpoints

  • Microsoft Entra ID and on-premises AD configured under Identity Provider Directories

  • Global Catalog disabled for AD

Issue

All new Entra ID-related properties return N/A, even on fully Entra-joined Windows endpoints.

Troubleshooting performed

  1. Entra join: Confirmed AzureAdJoined = YES and DomainJoined = NO.

  2. Client version: Verified 11.0.7.61.

  3. Entra connectivity: Searching for Entra users and adding them as BigFix operators works.

  4. Microsoft Graph: Entra sign-in logs show successful authentication by the BigFix application approximately once per hour.

  5. REST API:

    • /api/idpdirectories returns the configured Entra integration.

    • /api/idp/user/{id} returns Object not found.

    • /api/idp/computer/{id} returns Object not found.

    • /api/idp/group/{id} returns Object not found.

  6. Client Relevance:

    • idp directory type of client returns no value.

    • idp id of client returns no value.

  7. Restarted BES Root Server and BES Client services without improvement.

Questions

  1. How can we verify that the Identity Aggregation Service is actually running and successfully synchronizing data from Entra ID?

  2. Are additional Microsoft Graph application permissions required for the new functionality?

  3. Is there a specific log or debug setting for troubleshooting Entra synchronization?

  4. Can synchronization be triggered manually, or is there a configurable synchronization interval?

  5. Are there any known issues with Entra ID identity discovery in 11.0.7?

Since Entra authentication and user searches work, but none of the new properties populate, I'm trying to understand where the process is failing.

Any guidance from HCL or others who have successfully configured these new properties would be appreciated.

Thanks!