Technical Tip: How to check Azure the inherited (nested) groups for SAML login

In some cases, the user groups displayed in the Azure portal do not align with those listed in SAML Authentication. This discrepancy occurs because the Azure portal does not display inherited (nested) groups.

From the SAML debug log, there are five groups in the SAML assertion:

samld_send_common_reply [95]: Attr: 10, 108, 'http://schemas.microsoft.com/ws/2008/06/identity/claims/groups' '8724203f-b372-4648-b9ae-8254d36cf736'
samld_send_common_reply [95]: Attr: 10, 108, 'http://schemas.microsoft.com/ws/2008/06/identity/claims/groups' 'a425fb5d-8c25-4af2-bcf2-e59b349f17d8'
samld_send_common_reply [95]: Attr: 10, 108, 'http://schemas.microsoft.com/ws/2008/06/identity/claims/groups' '3ad24389-a0ed-47a7-ab0f-bf71573f51b6'
samld_send_common_reply [95]: Attr: 10, 108, 'http://schemas.microsoft.com/ws/2008/06/identity/claims/groups' 'f055bcad-8a59-4e71-a827-88ecebc45a27'
samld_send_common_reply [95]: Attr: 10, 108, 'http://schemas.microsoft.com/ws/2008/06/identity/claims/groups' 'bdc357d3-d318-4132-8a86-8f88bab5b4fa'

For example, the group 'chris top' may include two nested groups, 'chris' and 'chris1', but does not directly contain any users.

As a result, the nested group memberships may not appear in the Azure portal but are still included in the SAML assertion.

To verify the total groups, including inherited ones, use the following commands in the Azure Cloud Shell:

Related article:

Technical Tip: Understanding the limitation of 150 assertions from Microsoft Azure as SAML IdP that may cause group mismatch in FortiGate