You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: support/entra/entra-id/app-integration/get-signed-in-users-groups-in-access-token.md
+5-6Lines changed: 5 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,14 +10,13 @@ ms.custom: sap:Developing or Registering apps with Microsoft identity platform
10
10
11
11
When you configure the `groups` claim in an access token for your application, Microsoft Entra ID has a maximum number of groups that can be returned in an access token. When the limit is exceeded, Azure provides a groups overage claim which is a URL that can be used to get the full groups list for the currently signed in user. This URL uses the Microsoft Graph endpoint. For more information about the `groups` claim, see [Access tokens in the Microsoft identity platform](/entra/identity-platform/access-tokens).
12
12
13
-
This article introduces how to reproduce this scenario and get the actual user groups from the groupsoverage claim by using a sample project.
13
+
For JSON web tokens (JWT), Azure has a limit of 200 groups that can be present in the token. When requesting an access token for the resource that has the `groups` claim configured on it, if you are a member of more than 200 groups, you will get a groups overage claim instead of getting the actual groups.
14
14
15
-
> [!NOTE]
16
-
> For JSON web tokens (JWT), Azure has a limit of 200 groups that can be present in the token. When requesting an access token for the resource that has the `groups` claim configured on it, if you are a member of more than 200 groups, you will get a groups overage claim URL instead of getting the actual groups.
15
+
This article introduces how to get the actual user groups list from a groups overage claim by using a sample project.
17
16
18
-
## Configure access tokens for the groups claim
17
+
## Configure the groups claim for your application
19
18
20
-
You can configure optional claims for your application to include the groups claim. For more information, see [Configure and manage optional claims in ID tokens, access tokens, and SAML tokens](/entra/identity-platform/optional-claims).
19
+
You can configure the `groups` claim for your application by using the optional claims. For more information, see [Configure and manage optional claims in ID tokens, access tokens, and SAML tokens](/entra/identity-platform/optional-claims).
21
20
22
21
If the application is a first party app (Microsoft App), you can't configure the `groups` claim. You only can configure this with your own app registration. If you want to configure the `groups` claim for a client application, you must configure it in an ID token.
23
22
@@ -87,7 +86,7 @@ Download the sample project [MSAL.Net_GroupOveragesClaim](https://github.com/Ray
87
86
3. After signing in, close the browser, and you'll return to the console application.
88
87
4. After the access token is presented in the console window, copy the access token to the clipboard and paste it at https://jwt.ms to view the encoded token. It's just a user token.
89
88
90
-
If the user is a member of too many groups, the console window will display the original group overage URL and the new group overage URL for that token. The new group overage URL will be used in the .NET HTTP client request rather than the Graph .NET SDK request.
89
+
If the user is a member of too many groups, the console window will display the original group overage claim and the new group overage claim for that token. The new group overage claim will be used in the .NET HTTP client request rather than the Graph .NET SDK request.
91
90
92
91
:::image type="content" source="media/get-signed-in-users-groups-in-access-token/select-method-to-get-groups.png" alt-text="Screenshot of the methods be used to get the full list of the user groups." lightbox="media/get-signed-in-users-groups-in-access-token/select-method-to-get-groups.png" border="false":::
0 commit comments