Azure Entra ID Endpoint Filtering resulting in duplicate entitlements

[jasonb]

We have a large numbe of Entra ID groups, and have begun using EndPoint filtering to associate them with our applications using Endpoint Filtering on our Azure AD connector.

However, this has had the result of creating duplicate entitlements:

They are both referencing the same Entra ID group, but appear separately in all the entitlement lists.

Is there a best practice for managing this?  Is there a way to clean this up?

[rushikeshvartak · Accepted solution]

This is expected behavior. Entitlements and account gets created under child endpoint and reference to parent entitlement/account