Azure AD Groups Claim only contains 1 Group but user is assigned to multiple Groups

Loran Saggu 0 Reputation points
2023-10-05T17:31:22.0766667+00:00

I am using Azure AD (Entra) as an Identity Provider (IdP) for an SAML SSO Connection into Salesforce (the service provider). We would like to receive Group Membership in the SAML response from Azure. We have specified that our Group Claim should include All Groups. The issue is that when we receive the claim in Salesforce, we only see a single Group Id when the user is assigned to multiple groups in Azure...

We are on a free tier (while testing) in Azure. Is there anything that we should be doing to obtain all group ids in the claim in Salesforce?

Config in Azure:

User's image

Response in Salesforce (there is only 1 group Id where there should be 3):

{"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname":"Person","http://schemas.microsoft.com/claims/authnmethodsreferences":"http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password","http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name":"******@testssooutlook.onmicrosoft.com","http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname":"Test","http://schemas.microsoft.com/identity/claims/objectidentifier":"9ddec433-1fb2-4ed3-bfba-209a90cbebd5","http://schemas.microsoft.com/identity/claims/identityprovider":"https://sts.windows.net/107be8f6-e69c-4de9-b304-a8785a6d531f/","http://schemas.microsoft.com/identity/claims/tenantid":"107be8f6-e69c-4de9-b304-a8785a6d531f","http://schemas.microsoft.com/ws/2008/06/identity/claims/wids":"9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3","http://schemas.microsoft.com/ws/2008/06/identity/claims/groups":"33514b82-a659-4247-a2f2-44674d9ec1b3","http://schemas.microsoft.com/identity/claims/displayname":"Test Person"}
Microsoft Entra
Microsoft Entra
A group of Microsoft multicloud identity and access solutions.
2,555 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
24,256 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.