Is it possible to send an empty group claim when a user is not assigned to a group?

Question

I am using Okta as an Identity Broker and Azure as an external IdP and wish to control permissions for my app in Okta using the groups a user is assigned to in Azure. This has been working fine except for the fact that when a user is removed from a group in Azure and is no longer assigned to any groups, rather than passing an empty group claim, Azure doesn't pass a group claim at all. This results in Okta not updating the list of groups a user is in. To resolve this issue I was looking for a way to always pass a group claim, even if it is an empty list.

I found some documentation specific to group claims and tried some things from the article

Things I've tried...

• Setting the group claim to "essential" in my application's manifest file in azure
• Using "emit_as_roles" to emit the group claim as a role claim

Both of these still neglect to send a group claim (or role claim) even when a group claim has been added to the token configuration for my application

Answer 1

@Garrett Wells

Azure AD doesn't send any configured claims if it the attribute carries no value in it. Usually if user is not part of any group and if there is group claim configured, then Azure AD will not send the group claim in the token.

This is the behavior for now. However, you can submit feedback in Azure feedback portal below to change this behavior.
https://feedback.azure.com/d365community/search/22920db1-ad25-ec11-b6e6-000d3a4f0789?q=Azure+AD+token

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.