AD User Based Access - UTM 9.4

You have to use Username (User Network) and Group (User Group Network) objects in your firewall rules, not standard user and group objects.

That's what I am using on Firewall Rule and App Control. 

I did test blocking Skype for some Users (User network) but it does not work, App Control Live Log shows no traffic, I can only see traffic on Web Protection Live Log which states that skype is allowed for user ......

I am using Web Protection Transparent Mode with SSO. Users have UTM Lan IP configured as their proxy address.  

I've tested STAS only with firewall rules where it works without any problem using User Network objects.

For Web Filtering try with changing Default authentication from AD SSO to Agent . It is obviously undocumented STAS feature described in this forum post:
https://community.sophos.com/products/unified-threat-management/unified-threat-management-beta/utm_94_beta/f/140/p/75192/289667#289667

Please post results back.

I've tested STAS only with firewall rules where it works without any problem using User Network objects.

For Web Filtering try with changing Default authentication from AD SSO to Agent . It is obviously undocumented STAS feature described in this forum post:
https://community.sophos.com/products/unified-threat-management/unified-threat-management-beta/utm_94_beta/f/140/p/75192/289667#289667

Please post results back.

After some testing my believe is that User Based Access on Firewall Rules and App Control will only work if you completely disable Web Filtering, that's the only time it works with me. Disabling Web Filter is not an option for us here since we definitely need it Enabled.