diff --git a/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/etc/nevis/k8s-nevisauth-7022472ae407577ae604bbb8.yaml b/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/etc/nevis/k8s-nevisauth-7022472ae407577ae604bbb8.yaml
index 8515a22..bd2d2d4 100644
--- a/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/etc/nevis/k8s-nevisauth-7022472ae407577ae604bbb8.yaml
+++ b/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/etc/nevis/k8s-nevisauth-7022472ae407577ae604bbb8.yaml
@@ -45,7 +45,7 @@ spec:
   podDisruptionBudget:
     maxUnavailable: "50%"
   git:
-    tag: "r-e2938d9f50d18f0c7df1e51a7cc98a1e4fe2f6fa"
+    tag: "r-e00a9c4734572d2d12c47637bd8775b8447b2904"
     dir: "DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth"
     credentials: "git-credentials"
   keystores:
diff --git a/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/checkloa.groovy b/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/checkloa.groovy
index ca33274..dc2bc6c 100644
--- a/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/checkloa.groovy
+++ b/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/checkloa.groovy
@@ -170,6 +170,15 @@ try {
       } 
     } 
   }
+
+  LOG.debug('CheckLoa: Highest role Level ' + highestRoleLevelNumber.toString() +' contextclassref ' + requestedRoleLevelNumber.toString()) 
+  LOG.debug('CheckLoa: Compare ' + (highestRoleLevelNumber>=requestedRoleLevelNumber)) 
+
+  //set attribute Actual Role Level
+  session.setAttribute('agov.actualRoleLevel', '' + highestRoleLevelNumber)
+  LOG.debug('CheckLoa: actual role level (agov) '+ highestRoleLevelNumber)
+
+
   // Best Token Available only if account's AQlevel is high enough
   if ((session.getAttribute('agov.appAddressRequired') == 'true') && (highestRoleLevelNumber < 200)) {
      LOG.debug("Best Token: Address requested but account has to low AQ (${highestRoleLevelNumber})") 
@@ -179,12 +188,6 @@ try {
      LOG.debug("Best Token: SVNr requested but account has to low AQ (${highestRoleLevelNumber})") 
      session.setAttribute('agov.appSvnrAllowed', 'false')
   }
-  LOG.debug('CheckLoa: Highest role Level' + highestRoleLevelNumber.toString() +' contextclassref' + requestedRoleLevelNumber.toString()) 
-  LOG.debug('CheckLoa: Compare' + (highestRoleLevelNumber>=requestedRoleLevelNumber)) 
-
-  //set attribute Actual Role Level
-  session.setAttribute('agov.actualRoleLevel', '' + highestRoleLevelNumber)
-  LOG.debug('CheckLoa: actual role level (agov) '+ highestRoleLevelNumber)
 
   if (highestRoleLevelNumber > 0) {
     // set attribute contextClassRefToSet
diff --git a/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/esauth4.xml b/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/esauth4.xml
index 4016cc2..dc48929 100644
--- a/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/esauth4.xml
+++ b/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/esauth4.xml
@@ -168,9 +168,9 @@
                 <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
             </Response>
             <!-- source: pattern://68665057549fd887ea09fb86 -->
-            <property name="parameter.bestTokenAddressWhitelist" value="https://testapp-01.agov-d.azure.adnovum.net/test/api/saml2/service-provider-metadata/agovidp, OidcPlayground"/>
+            <property name="parameter.bestTokenAddressWhitelist" value="https://testapp-01.agov-d.azure.adnovum.net/test/api/saml2/service-provider-metadata/agovidp, OidcPlayground, https://admin.agov-w.azure.adnovum.net/SAML2/ACS/"/>
             <!-- source: pattern://68665057549fd887ea09fb86 -->
-            <property name="parameter.bestTokenSvnrWhitelist" value="https://testapp-01.agov-d.azure.adnovum.net/test/api/saml2/service-provider-metadata/agovidp, OidcPlayground"/>
+            <property name="parameter.bestTokenSvnrWhitelist" value="https://testapp-01.agov-d.azure.adnovum.net/test/api/saml2/service-provider-metadata/agovidp, OidcPlayground, https://op.agov-w.azure.adnovum.net/SAML2/ACS/"/>
             <!-- source: pattern://68665057549fd887ea09fb86 -->
             <property name="parameter.url" value="https://utility.agov-d.azure.adnovum.net/connect/billing/relying-party"/>
             <!-- source: pattern://68665057549fd887ea09fb86 -->