Issue with Regex custom group claim

Brule, Joshua L. (Josh) 0

For most users this works fine and returns the teams claim as expected. My account has 186 groups and has no issues. However we have a user with 305 group memberships and the claim is failing to be created and instead we are getting a claim named: [http://schemas.microsoft.com/claims/groups.link], after filtering this user should only have around 30 groups in the claim.

I am aware of the 150 group limit (I believe that is after filtering) but it doesn't seem to be an issue judging by the success of my account (186 groups) so I was wondering if there is a known limit when using Regex Replacement Pattern

The documentation for Regex Replacement Pattern notes -> "You can also use the regex transform feature as a filter, because any groups that don't match the regex pattern will not be emitted in the resulting claim."

The application assigned groups are being exposed as [roles] user.assignedroles. We want these regex filtered groups to be passed for [teams] assignment within the app.

Screenshot 2024-11-12 at 5.46.19 PM

Screenshot 2024-11-12 at 5.37.44 PM

1 answer

Raja Pothuraju 8,970 Reputation points Microsoft Vendor

2024-11-13T03:52:06.97+00:00

Hello @Brule, Joshua L. (Josh),

Thank you for posting your query on Microsoft Q&A.

Based on your description, I understand that you have added a custom Regex group claim to your SAML application. This claim is being correctly passed for all users except one, who has 305 group assignments. In the SAML response for this particular user, you’re seeing a claim with the name http://schemas.microsoft.com/ws/2008/06/identity/claims/groups containing around 30 group IDs, instead of the expected "teams" claim. The primary difference between the working and non-working scenarios seems to be the higher number of groups assigned to this user.

To further understand the issue, could you try using "Groups assigned to the application" rather than selecting "All groups"? This might help us determine if limiting the scope of group claims resolves the problem.

Thanks,
Raja Pothuraju.
Please sign in to rate this answer.
Brule, Joshua L. (Josh) 0 Reputation points

2024-11-13T14:44:30.5833333+00:00

It is not returning a "teams" claim (and the expected 30 groups) for the user. It is returning [http://schemas.microsoft.com/claims/groups.link] with nothing instead. I can get it to return some matches if I use the Filter groups option. But that only provides a subset of groups we are seeking. I am using the Regex as an OR filter.

Brule, Joshua L. (Josh) 0 Reputation points

2024-11-13T14:52:43.99+00:00

It just seems totally silly to require adding all these groups to the application. There are 400+ of them.

I am using the Regex as an OR filter. If Filter groups had an OR option that would be perfect.

Raja Pothuraju 8,970 Reputation points Microsoft Vendor

2024-11-14T04:03:59.12+00:00

Hello @Brule, Joshua L. (Josh),

Thank you for your response and for sharing the additional details.

To better understand the scenario, I’d like to discuss this offline with you so I can review the logs in detail. This will help me provide you with a more accurate solution. Please send me an email on azcommunity@microsoft.com referencing this issue with a subject line "ATTN:pothurajur" include a link to the current thread.

Looking forward for your response.

Thanks,
Raja Pothuraju.

Raja Pothuraju 8,970 Reputation points Microsoft Vendor

2024-11-15T17:31:05.31+00:00

Hello @Brule, Joshua L. (Josh),

Thank you for sending an email offline. Let's connect offline as per your feasible time to understand the scenario much better.

Raja Pothuraju 8,970 Reputation points Microsoft Vendor

2024-11-26T07:08:28.1433333+00:00

Hello @Brule, Joshua L. (Josh),

Thank you for connecting with me offline to troubleshoot the issue.

After reviewing the SAML response for both the working and non-working scenarios from the support ticket, we identified the following:

User Brule has a total of 186 direct group assignments, 126 of which are security groups. This count is below the 150-group limit.

User Pankratz, on the other hand, has a total of 306 group assignments, including 219 security groups, which exceeds the 150-group limit.

This explains why the application works for Brule but not for Pankratz, as the latter exceeds the group membership threshold.

Add group claims to tokens for SAML applications using SSO configuration

To resolve this issue, we need to adjust the claim to Groups assigned to the application to include only the required claims while staying within the group membership limit.

During our call, we observed that your application is using app roles to receive role claims in the token. When you attempted to assign groups under the "Users and Groups" tab to proceed with the workaround "Groups assigned to the application," you noticed that selecting an app role was mandatory. However, you don't want to assign roles to all the groups added, as doing so would result in role claims being included for all users logging into the application.

To address this, I’d like to clarify that if your application has app roles enabled, selecting a role is indeed mandatory when assigning groups. However, you can assign the "User" role (a default role for applications in Entra) to these groups. This allows you to add groups to the application without including any role claims in the SAML token. Select the "User" role whenever assigning groups to the application. Please refer to the screenshot below for further clarity.

Add app roles to your application and receive them in the token

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,
Raja Pothuraju.

Raja Pothuraju 8,970 Reputation points Microsoft Vendor

2024-11-27T11:09:34.84+00:00

Hello @Brule, Joshua L. (Josh),

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Raja Pothuraju 8,970 Reputation points Microsoft Vendor

2024-11-28T10:43:19.2+00:00

Hello @Brule, Joshua L. (Josh),

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Issue with Regex custom group claim

1 answer

Your answer