Azure SAML not sending one of the configured group claim attribute in the response after authentication is successful

Question

Azure SAML not sending one of the configured group claim attribute in the response after authentication is successful

Malla Venu Gopal 0

Does azure saml sso fails to send attributes for a specific user assigned to the enterprise application? The response is fine for all the assigned users, it’s not sending the one of the mapped attributes only for one assigned users, which is groups attribute. In short it is sending all the attributes of the user in the response except the groups attribute for a single assigned user but works fine for all the assigned users. I can see all the group memberships of the user in azure ad, but it is not even sending one in the saml response. I have verified the response of the user using saml tracer, it’s sending the groups attribute for all the users but not for that single user.

Navya 20,180 Reputation points Microsoft External Staff Moderator

2024-08-08T05:22:15.33+00:00

Hi @Malla Venu Gopal

Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.
Navya 20,180 Reputation points Microsoft External Staff Moderator

2024-08-12T04:06:09.8666667+00:00

Hi @Malla Venu Gopal

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

1 answer

Your answer

Navya 20,180 Reputation points Microsoft External Staff Moderator

2024-08-08T05:22:15.33+00:00

Hi @Malla Venu Gopal

Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.
Navya 20,180 Reputation points Microsoft External Staff Moderator

2024-08-12T04:06:09.8666667+00:00

Hi @Malla Venu Gopal

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Answer 1

Navya 20,180 Microsoft External Staff Moderator

Hi @Malla Venu Gopal

Thank you for posting this in Microsoft Q&A.

I understand that Azure SAML is not sending one of the configured group claim attributes in the SAML response for a user, although all other users are able to receive group claims.

It appears to be an issue with one user, not the Azure SAML. To better understand the problem, could you please share more details about the configuration of group claims? For instance, which group option have you configured in the SSO configuration? Also, could you please verify whether the user exists in the group that you have configured in SSO?

Thanks,

Navya

Malla Venu Gopal 0 Reputation points

2024-08-06T18:58:04.7333333+00:00

Hi Navya, Thanks for the response!

This is what configured for the groups claim
Navya 20,180 Reputation points Microsoft External Staff Moderator

2024-08-07T07:03:39.3433333+00:00
Hi @Malla Venu Gopal

Thank you for sharing information about the configuration of group claims in SAML. Based on the information, I understand that you have selected the 'all groups' option under group claims. All groups option includes security groups, distribution lists, and roles.

Please verify if the user has any roles or is a member of any group in the Entra admin center. You can also use PowerShell commands to check this.

Connect-AzureAD Get-AzureADUserMembership -ObjectId ******@M365x.onmicrosoft.com

To receive group claims in a SAML response, a user must be a member of any group. Try to assign a role to the user and verify whether it appears in the SAML response.
Malla Venu Gopal 0 Reputation points

2024-09-03T11:11:51.6933333+00:00

Hi Navya,

Yes the user is part of many groups including on-prem, cloud groups, distributions lists. I've found an article(provided the link below) which says that the groups claim will be sent in the response only if the user is apart of less than or equal to 150 groups. We tried removing the user from some of the groups and made it 149 which still doesn't work.

Link: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims

Share via

Azure SAML not sending one of the configured group claim attribute in the response after authentication is successful

1 answer

Your answer