Sophos XG VPN - AD users are enabled automatically with VPN capability

Hey Ninjatech1969, Thanks for reaching out to Sophos Community.

Ensure that the Group 'SSL VPN' You've imported from the AD has the SSL VPN profile selected under the group settings. Alternatively, You can explicitly add that group in the specific SSL VPN policy as well.

Hey Ninjatech1969, Thanks for reaching out to Sophos Community.

Ensure that the Group 'SSL VPN' You've imported from the AD has the SSL VPN profile selected under the group settings. Alternatively, You can explicitly add that group in the specific SSL VPN policy as well.

Hey DeveshM,

thanks for the reply. Where do I do this in XG? -  Alternatively, You can explicitly add that group in the specific SSL VPN policy as well. 

Just open the SSL VPN Policy on XG, Goto Identity > Policy Members, and add the SSL VPN group here.

The problem with doing it that way every user that gets created in XG is part of the VPN-Users group and I cant remove it sicne its grayed out

Do you have selected the imported "VPN" group as default group under Authentication - Services? If yes, change it back to open group.
Per default there is "Open Group" configured.

Great ! Thanks for the help @Nafets and Devesh I think that did it ! 

Great..! Glad to know the issue was narrowed down :) 

Great :-)

any pointers on how I cam make the login script to run option. I put a checkmark on the option with no luck?

Just so clarify: Do you want to use SSLVPN or the sophos connect client?
With SSLVPN you have the option to automatically execute a script (Run script on client after successful connection? - VPN: Site to Site and Remote Access - UTM Firewall - Sophos Community)