Result Unknown User Group. Azure AD connector get group members returns maximum 100 users. We can see that the first result value is a NULL represented by an empty string the empty line before the IT department.
HKEY_LOCAL_MACHINE and HKEY_USERS i found a user group built-in security object called RESTRICTED with read permission. In other words it creates a report that displays what group policies objects are applied to a user and computer. Ok this might be a deliberate feature but 1 it is not documented in the connectors documentation 2 I dont see a way to circumvent it in order to be able to handle larger groups in a larger organization.
Through the Group Policy Management Console you can see all the settings that a specific GPO will apply to machines and users in that OU but because the Active Directory is hierarchical you have to drill down into further Organizational Units in order to find if a more specific GPO might be affecting the target machines.
Since I cant find the User as being a member of the Security Group you will not be surprised to discover that GP Modelling doesnt indicate the the GPO will apply to the User - and it doesnt. GPResultexe is a console administrative tool designed to analyze and diagnose group policy settings that are applied to a computer andor user in the Active Directory domain. I also used the Teams Skype admin center to check to on them but they are not listed there as users neither is my gmail account which is functioning as a guest in Teams but my. This empty space represents all the NULL values returned by the GROUP BY clause so we can conclude that GROUP BY treats NULLs as valid values.