webfilter by SSO group?

[tk34]

I have created and SSO seems to be working. In my logs (AD) I see logon events coming from the FG. In FG I see AD usernames. So I created a group and set a policy with that Webfilter applied, selecting that group. However it seems to work opposite of what I thought. It seems to allow that group through. The default policy doesn' t block much and P2P, IM, File sharing sites, etc. The other profile is more specific, no FB, no Pandora. I' m looking for the correct documentation on FG KB site but can' t seem to find the one I used to set this up. Effectively I' m trying to block one department, our call center, from using radio or facebook (and a few other sites). While allowing other departments access.