Using FMG to configure SAML on FGT

Hello,

I am trying to use our FortiManager to configure SAML (using Azure) for VPN access to our remote FGT's as a "break glass" means of getting access to our FGT should the FMG be offline or the HQ site is destroyed.  The idea is that we can VPN in to the remote FGT and then access the Admin console from the inside rather than have the Admin console facing the outside.

I have entered all the Azure url's and certificate per what instructions I have found.  When I go to the VPN Settings and attempt to add the Azure user group I get this error.

user/saml/azure/ : datasrc invalid. object: vpn ssl settings authentication-rule.1:groups. detail: <group name>. solution: datasrc invalid

I have poured over the user group and I can find nothing that points me to what this error is referring to or how to resolve it.  I understand that the "datasrc is invalid" but I have not found the datasrc that is causing the issue.  I've tried following this link...

https://docs.fortinet.com/document/fortigate-public-cloud/7.2.0/azure-administration-guide/584456/configuring-saml-sso-login-for-ssl-vpn-with-azure-ad-acting-as-saml-idp

but I get stopped at the SSL VPN settings.

Any bread crumbs would be greatly appreciated.

Thanks,

Mattt

FMG: v7.4.2

FGT: v7.0.9