Azure AD Groups Claim only contains 1 Group but user is assigned to multiple Groups
I am using Azure AD (Entra) as an Identity Provider (IdP) for an SAML SSO Connection into Salesforce (the service provider). We would like to receive Group Membership in the SAML response from Azure. We have specified that our Group Claim should include All Groups. The issue is that when we receive the claim in Salesforce, we only see a single Group Id when the user is assigned to multiple groups in Azure...
We are on a free tier (while testing) in Azure. Is there anything that we should be doing to obtain all group ids in the claim in Salesforce?
Config in Azure:
Response in Salesforce (there is only 1 group Id where there should be 3):
{"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname":"Person","http://schemas.microsoft.com/claims/authnmethodsreferences":"http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password","http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name":"******@testssooutlook.onmicrosoft.com","http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname":"Test","http://schemas.microsoft.com/identity/claims/objectidentifier":"9ddec433-1fb2-4ed3-bfba-209a90cbebd5","http://schemas.microsoft.com/identity/claims/identityprovider":"https://sts.windows.net/107be8f6-e69c-4de9-b304-a8785a6d531f/","http://schemas.microsoft.com/identity/claims/tenantid":"107be8f6-e69c-4de9-b304-a8785a6d531f","http://schemas.microsoft.com/ws/2008/06/identity/claims/wids":"9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3","http://schemas.microsoft.com/ws/2008/06/identity/claims/groups":"33514b82-a659-4247-a2f2-44674d9ec1b3","http://schemas.microsoft.com/identity/claims/displayname":"Test Person"}