please remove the SSO and make the policy for the blocking of internet then it works

please review your SSO policy .it looks the problem at your policy .

Specify the users that needs authentication and once authenticated can connect to the internet.

Just input the IP address or hostname of your NGAF device.

1) Review policy configuration to ensure SSO traffic is not inadvertently blocked.
2) Whitelist SSO traffic by creating exceptions or allowing necessary ports/protocols/URLs.
3) Check network connectivity between user devices and SSO server.
4) Verify proper Active Directory integration and SSO authentication settings.
5) Monitor NGAF logs for blocked SSO traffic or authentication failures.
6) Review SSO configuration and consult documentation or vendor for guidance.
7) Contact Sangfor technical support for further assistance if the issue persists.

To prevent the internet access of the 3 test users who bypassed authentication, you can create access control rules on Sangfor NGAF to block their IP addresses from accessing specific websites or the internet entirely.

Your IdP SSO profile settings may be usable only if you use them to configure the SSO profile for your organization.

In the NGAF management interface, look for the Firewall Policy section or something similar. This is where you may configure internet access rules.

Access the Sangfor NGAF management interface: Open a web browser and enter the IP address or hostname of your NGAF device to access the management interface.

Specify the AD authentication requirement: Configure the authentication method to utilize Active Directory inside the policy settings. This guarantees that before being allowed internet access, users must verify against AD.