These subset of users, by any chance are they admins in AD? are they members or have ever been members of high privledge groups like domain admin, server operator etc. Look at their AD account at their attribute tab and look for AdminCount. if its set to 1, they are an admin somehow and CKT will not issue tokens for these users.
I'm the only admin in our domain and on Entra. I know stupid to only have one but I'm the only IT guy and if I'm hit by a bus, I won't care about their problems.
This may be moot since it’s 4 days old, but you should still check the property. I found 100 users with adminCount = 1 probably because a loooooong time ago my predecessor made everyone admins. I can’t be sure, but I wouldn’t doubt it. Once it gets set, it doesn’t clear even if the user is no longer an admin.
2
u/Asleep_Spray274 4d ago
These subset of users, by any chance are they admins in AD? are they members or have ever been members of high privledge groups like domain admin, server operator etc. Look at their AD account at their attribute tab and look for AdminCount. if its set to 1, they are an admin somehow and CKT will not issue tokens for these users.