Azure AD Groups Missing in Auth0 Post-Login Action Using OIDC Connection

When using an OpenID Connect (OIDC) connection for Azure Active Directory (Azure AD), an Auth0 Post-Login Action fails to validate user groups because the event.user.groups property returns empty. This occurs when the Enterprise Application in Azure AD lacks the required group assignments, or the Auth0 connection settings lack the groups scope. To resolve this, assign the groups to the Azure AD Enterprise Application and include the groups scope in the Auth0 OIDC connection configuration.

• Auth0
• Post-Login Actions
• OpenID Connect (OIDC) Connections
• Azure Active Directory (Azure AD)

The event.user.groups property fails to populate in the Auth0 Action because the Enterprise Application registry in Azure AD lacks the required access group assignments. Additionally, the OIDC connection configuration in Auth0 lacks the groups scope. Unlike the bespoke Microsoft Azure AD Enterprise Connection, which retrieves all groups associated with a user, the OIDC connection only returns groups explicitly assigned to the Enterprise Application in Azure AD.

How are Azure AD groups configured for an OIDC connection?

Assign the required access groups within the Azure AD portal and append the 'groups' scope to the Auth0 connection settings to ensure Auth0 receives the claims successfully.

1. In Azure AD, navigate to the Enterprise Application registry.
2. Assign the required access groups to the application.
3. In the Auth0 Admin Console, navigate to the OIDC connection settings.
4. Add groups to the scope list.
5. Test the login and use console.log(event.user) in the Post-Login Action to verify that the groups populate correctly.

How is the bespoke Azure AD Enterprise Connection configured to retrieve all groups?

Create a dedicated Microsoft Azure AD Enterprise Connection and enable the group retrieval setting to fetch all groups associated with the user.

1. In the Auth0 Admin Console, create a Microsoft Azure AD Enterprise Connection.
2. Enable the Get user groups option in the connection settings.