When adding a Profile Group to a policy there are 2 potential points of confusion:
1. Depending on your interpretation, there may be some confusion on the profile-type setting.
• group indicates the use of a profile group.
• single indicates the use of individual Security profiles.
2. In the CLI, the context, or placement in the "syntax tree" of configuration settings, can make some options available or unavailable depending on other settings.
In an Address Policy you only have to go down 2 "levels" to have the options for configuring the Profile Groups available.
When an Identity policy is being used the Profile Group options are not available at the same level. You have to go down a further 2 levels, to inside the Authentication rule that is nested within the overall umbrella of the Firewall Policy. This is where the Profile Group settings will be available to you.