Limit group claims to selected groups

In Azure AD (Microsoft Entra ID), group memberships can be included in the token of an enterprise application in order to control authorizations within the application.
However, as Azure AD only transfers up to 150 groups directly in the token, it makes sense to limit the scope of the group claims.

If a user is a member of more than 150 groups, this can lead to group information no longer being included in the token – which can result in missing authorizations in DeepCloud.

In this article you will learn how to:

• Add groups to an enterprise application, and
• configure the group claims,
  so that only the relevant (DeepCloud-related) groups are included in the token

Prerequisites

Before you start, make sure that the following points are fulfilled:

• A domain verification is active
• SSO configuration is activated
• SSO group mapping is activated

Restrict group claims to DeepCloud-relevant groups

To ensure that only the groups relevant for DeepCloud are included in the token, proceed as follows:

1. assign relevant groups

1. Open the Azure portal: https://portal.azure.com
2. Navigate to
   Azure Active Directory → Enterprise Applications
3. Select the corresponding Enterprise application (e.g. DeepCloud).
4. Open the Users and Groups menu on the left.
5. Click on + Add user/group.
6. Select the DeepCloud-relevant groups.
7. Click on Assign to add the groups

2. configure group claims

1. In the Azure portal, navigate to
   Azure Active Directory → Appregistrations.
2. Select the relevant app registration (client application).
3. Go to Manage → Token configuration
4. Click on + Add group claim.
5. Select in the dialog:
   • Groups assigned to the application
     (Recommended for large companies in order not to exceed the group limit in the token).
6. Click on Save.

Result

After this configuration, the ID or access token will only contain the group IDs of the assigned DeepCloud groups.
This keeps the tokens lean, the Azure limits are respected and the DeepCloud authorizations are correctly maintained.