ztna on firewall .. Clientless access to internal webpage results in 403 -- how to troubleshoot

hi all,

my problem: i get an HTTP ERROR 403 while trying to access an "internal" webserver.

i have created a azure-ad with user + group
i have created the central-sync as app within azure
azure-user and group is added to central users/groups
i have created a gateway gw.ztna.mydomain.de
gateway status within central is "connected".
i have created a clientless resource www.ztna.mydomain.de and assigned the azure-group

If I try to access the clientless resource, i have to logon in azure and if authentication is successful, i got the 403 error.

i can#t find any events or logging within azure or central or firewall ...
Where to start?

thanks,

Dirk