> For the complete documentation index, see [llms.txt](https://docs.collibra.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.collibra.com/data-quality-self-hosted/security-configuration/saml-authentication/configuring-saml-sso-for-azure.md).

# Configuring SAML SSO for Azure

When using SAML SSO with Azure as the provider, some additional configuration is required to read the groups and map roles.

When groups are pulled from Azure Active Directory SSO and more than five groups are assigned to a user, the group claims return as a link, rather than the groups list:

`<Attribute Name="http://schemas.microsoft.com/claims/groups.link">`

{% hint style="info" %}
Go to <https://learn.microsoft.com/en-us/azure/active-directory/develop/reference-saml-tokens> for more information about SAML security tokens
{% endhint %}

{% hint style="info" %}
For customers who have setup and configured the application to return groups that are only present in the SSO application, this issue is not applicable.
{% endhint %}

When Azure SSO sends a group.link assertion, the application tries to resolve the groups via the link. To activate the link, you must configure the `SAML_GROUPS_LINK_PROP` property.

## Steps

{% stepper %}
{% step %}
Add the following property to your **owl-env.sh** file:

<table><thead><tr><th width="152">Property</th><th>Description</th></tr></thead><tbody><tr><td>SAML_GROUPS_LINK_PROP</td><td><p>Configure this property equal to the group link claim name.</p><p>Go to <a href="/data-quality-self-hosted/security-configuration/saml-authentication/configuring-saml-authentication.md">Configuring SAML authentication</a> for more information about configuring SAML authentication properties.</p></td></tr></tbody></table>
{% endstep %}

{% step %}
Obtain a client key from Azure and configure both `AZURE_CLIENT_SECRET` and `AZURE_CLIENT_ID` properties, using the following documentation:

<https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal#option-2-create-a-new-application-secret>

{% hint style="info" %}
You must also ensure that the application, not delegate, has the MS Graph API application permission **directory.read.all**.
{% endhint %}

{% hint style="info" %}
In the IdP setup in Azure, verify that the Sign-on URL is not populated.
{% endhint %}
{% endstep %}
{% endstepper %}