Hi, this is an example configuration where I return a "UserRole" claim based on the groups - I use regex to remove the prefix of the group:
If there is only one role per user, a more straightforward method of implementation would be to add a regular claim with "Claim conditions" based on groups. In my opinion, this is preferable, as regex can be quite daunting.
I would also recommend verifying the content of the claim yourself. Developers are not infallible - the claim might be present in the token, and the issue could lie with the configuration or application on the other end.
Here’s how you can check the claim content:
- Open the developer mode in the Edge browser (F12).
- Switch to the "Network" tab.
- Enable "Preserve Log".
- Attempt to log in to the application (it doesn’t have to be successful).
- Search for "saml" in the network traffic and copy the value from the payload that is sent to the application's reply URL.
- Decode the token (I personally recommend using samltool.io) and check what is being passed by Entra.
If you update your post to include a screenshot, we can provide more specific feedback on your configuration. Let me know if you have any further questions, and remember to mark the best answer :)