CODEWITHSUNDEEP
azureazure-active-directory
Pradeep
Pradeep

Reputation: 105

Azure group claim returns Object ID - Need group name

Have been using Azure for Single Sign On.

For group claims, during the assertion we see only the security group object ID during the response.

e4feedb1-df0e-46ff-8a02-e63474015610

Is it possible to get Group name here in response instead of groups Object ID

Upvotes: 10

Views: 7105

Answers (2)

Philippe Signoret
Philippe Signoret

Reputation: 14356

If (and only if) the groups in question are groups which have been synced from on-premises AD, you can configure the groups claim to include the on-premises sAMAccountName or the on-premises SID.

Note: Including the display name is not supported. (Display names are not unique, and in most organization, any user is able to create and manage their own groups, making any sort of authorization decision based on group display names a very risky proposition.)

To issue group can be done both for gallery or non-gallery (i.e. custom) SAML apps (i.e. under Enteprise apps), through the app registration in the Azure portal (App registrations > Token configuration), or directly on the app registration's Application object by updating the optionalClaims property (e.g. via the manifest editor or through Microsoft Graph).

Editing groups claim from the Azure portal

Upvotes: 7

Allen Wu
Allen Wu

Reputation: 16458

I'm afraid that it's only supported to get the object ids currently.

You need to call Microsoft Graph to get the Group name.

If you do need this feature, upvote this post on UserVoice and it may be implemented in the future.

A similar question which is answered by Microsoft Engineer here.

Upvotes: 4

Related Questions