Does it differ based on the user? If the Groups claim filter/expression you have created does not result in any matches for the user logging in, their token will not contain the ‘groups’ claim (same as with any other attribute that may be getting pulled into a claim).