Can I restrict a network to one group?

Yes. Choose an Entra group for the client and only its members can connect. Membership is read from Microsoft every ten minutes and checked on every connection. Someone added to the group can connect within about fifteen minutes. Removing a group from the list applies on the next connection, even if Microsoft can't be reached.

It needs the optional GroupMember.Read.All permission. Without it, Passbeam can tell an account is enabled but not whether it's in the group, and it says so.

If Microsoft can't be reached, Passbeam uses the last answer it had, for up to 8 hours to let someone on and up to 7 days to keep someone off. After that, connections are allowed, so a Microsoft outage doesn't take your network down. Each one is in the authentication log with the reason.