Azure SAML customize group claim uses "group id" instead of object id

Question

If I set up a group claim for SAML SSO in an enterprise app the "Apply regex replace to groups claim content" is applied to a GUID that appears to having nothing to do with the group. The group object id is not the same as the id that comes out of Azure in this filter.

If I use the regex:

(?'fromAzure'.*)

and add content to the claim with:

{fromAzure}

i.e. pass-through whatever Azure is using as the "content" of the group I see a GUID that has nothing, apparently, to do with the group and is not the group object id.

Answer 1

Hi @Alistair Young , have you looked through this document? Can you also send a screenshot of your claim so I can reference it? Are you using the portal?