Search code examples
azureazure-active-directory

Azure SAML Group Claim Filtering

I am using Azure for SSO to an application. Azure syncs to our AD, so I am using SAMAccountName with Group Filtering to only pass certain group where the group name contains certain strings. However, I can't seem to figure out how to match multiple strings.

For example, I can get it to match groups that have the string "test" but I need to pass groups that match either "test" and "user". So in this case both testgroup and usergroup would be passed. Is this possible?

My current settings are:

Attribute to Match: SAMAccountName

Match With: contains

String: test,user

Solution

  • Currently Microsoft doesn’t support matching groups with multiple strings at a time. It’s possible to filter one at a time to verify desired results.

    You can configure filters to be applied to the group's display name or SAMAccountName attribute.

    Contains: Matches any location in the selected attribute.

    Filtering String should be either test or user. In that way, you can pass either testgroup or usergroup at one time.