When using the Role Endpoints list property to calculate whether a role should be assigned to a session, do all fields of the EndpointType have to be populated and if not what are the rules for calculating a match? It seems that it could be useful for example to only specify a security mode and/or security policy and not be concerned about the other fields.

If it is allowed to partially populate the structure I presume a match is made if all populated fields match the corresponding fields of a connected endpoint (AND of all populated fields).