Menu
I need my Azure AD to issue a claim with security group names. But there are only group object ids come out in the JWT token.
How to get security group names?
What I did so far: 1. Created a test security group and assigned a user to it. This is the only group for this user.
Set the groupMembershipClaims to All (integer 7) as it is in this official document https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-app-manifest
here is the relevant part of the application manifest:
{
...
"appRoles": [],
"availableToOtherTenants": false,
"displayName": "Azure AD B2C sandbox App ",
"errorUrl": null,
"groupMembershipClaims": "All",
"optionalClaims": null,
"acceptMappedClaims": null,...
638
Overview. Group Claims automatically add the user to a group or remove the user from group memberships when the group claim in the SAML token contains a matching group in NetDocuments. Administrators only need to update group memberships in one place.
Azure AD Connect excludes built-in security groups from directory synchronization. Azure AD Connect does not support synchronizing Primary Group memberships to Azure AD.
A Group Claim is a lawsuit with many claimants. Claimants can be either companies or individuals. Most commonly a Group Claim will initially focus on one claimant whose circumstances are representative of the others, a type of test case.
Nested groups in Azure AD are not supported within all scenarios. When you select a list of groups, you can assign a group expiration policy to a maximum of 500 Microsoft 365 groups. There is no limit when the policy is applied to all Microsoft 365 groups.
You cannot get them in tokens. As you noticed, you only get the ids. Usually this is good, since the id cannot be changed, unlike the name which can change.
If you want to do authorization based on groups, you can set the ids in a configuration file and then check with the id.
If you want the names for some other purpose, you'll need query the groups from Microsoft Graph API. You can find the API documentation here: https://developer.microsoft.com/en-us/graph/docs/api-reference/v1.0/resources/groups-overview
66
You can get the AD group name thru Token configuration. By default, it is return Group ID but you can change it to sAMAccountName.
36
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
