Intermittent user authentication issues on XGS firewall with STAS and Heartbeat - Best practice?

Question

Hi everyone, I have a full Sophos environment with an XGS firewall, Intercept X endpoints, and Sophos Central. On the firewall, I have Active Directory authentication configured and STAS running on the domain controller. My firewall rules use the "Match Known User" option and reference specific Active Directory users or groups. 
 The issue I&rsquo;m facing is that, while most of the time user authentication works fine, sometimes a few users are not authenticated and don't appear in the "Live Users" list on the firewall, so they can't access resources behind policies requiring user match. 
 Additionally, I noticed that some users appear in "Live Users" authenticated via STAS, while others appear authenticated via Heartbeat. I don't understand why Heartbeat doesn't always handle authentication for all users, since all endpoints have Intercept X installed and are connected to Sophos Central. 
 My questions are:

What could cause these intermittent authentication failures where users are not shown in Live Users?

Why does authentication sometimes happen via STAS and sometimes via Heartbeat?

Considering I have a complete Sophos ecosystem, what is the best and most reliable method to authenticate users on the firewall and apply user-based firewall rules (micro-segmentation)?

Any guidance, recommended configuration, or official documentation link would be appreciated. 
 Thank you!

Vivek Jagad · Answer

Hi Luc_GLLM , Thank you for reaching out to the community, would recommend to use any one authentication at a time. And to avoid the conflict of authentication between STAS and heartbeat, use the following steps mentioned in the article below: REF: Synchronized user ID authentication - Sophos Firewall 
 Turn off synchronized user ID authentication 
 Synchronized user ID authentication is turned on by default. To turn it off, do as follows: 
 
 Access the Advanced Shell. 
 
 Run one of the following commands: 
 
 To keep it turned off even after the firewall restarts: touch /content/no_userid 
 To only keep it turned off until the firewall restarts: touch /tmp/no_userid

To restart the access server service, run the following command: service access_server:restart -ds nosync NOTE: The change in status isn't included in backups. You must turn it off again if you restore a backup.