How to create/update a group by assigning SAML attributes

[hsy3418]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Hello,

I want to adding claims for a group that linked to an enterprise application using terraform, the claims I am trying to add is a customRole that the enterprise application required for authorise the user, so the user can SSO to the app with the correct role, currently the claim can be added via the AAD UI(See the reference link of how to configure in UI), so I wonder if this process could be automated by calling existing APIs.

New or Affected Resource(s)

• azuread_group

Potential Terraform Configuration

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key.

References

• (https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-group-claims#add-group-claims-to-tokens-for-saml-applications-using-sso-configuration)

[manicminer]

Hi @hsy3418, thanks for requesting this feature.

The API that exposes this functionality (https://main.iam.ad.ext.azure.com) is private and we are unable to use it. I believe the only way to configure this at present is by using the Azure Portal. I recommend raising a feature request with Microsoft via any channels you have available and we will do the same, unfortunately this will be blocked until such time as API functionality is made available.

Any additional information you might find, such as a Powershell or Azure CLI implementation, would be helpful and gratefully received.

[patrickmarabeas]

There's a community issue you can upvote here (was the response from our MS enquiry on the issue): https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/38536453-api-to-manage-saml-sso