question

Hi there,

When creating a JEA endpoint, you need to define one or more role capabilities that describe what someone can do in a JEA session. Make sure it has been done from the same link that you have shared

This issue occurs if the group has a member from another forest whose account has been removed from the account forest. The member is represented in the local domain by a Foreign Security Principal (FSP).

To resolve this issue, enable logging for the resolution requests that concern these SIDs and that are performed by the Active Directory Webservice. In this way, you can identify the accounts that fail resolution. To do this, run the Get-ADGroupMember cmdlet on the domain controller of contoso.com

You can get more info from here https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/get-adgroupmember-error-remote-forest-members

--If the reply is helpful, please Upvote and Accept it as an answer--

AD group I would like other team members to add themselves to temporarily leveraging MemberTimeToLive parameter is by default empty and it will contain other team members only after they submit PAM request adding them to the group - all accounts are from the same domain as AD group itself.

I just want to assure (although in the GUI tool code AD group name they will be added to is hard-coded) they can only add themselves to that group - ValidateSet of parameter Identity value should work but as I said if I do that Add-ADGroupMember is not visible cmdlet inside custom session configuration.