From 653441b3ac782fd8d01bf2bc2cd78b8a16d64c4d Mon Sep 17 00:00:00 2001 From: rcourtman Date: Tue, 4 Aug 2026 11:13:10 +0100 Subject: [PATCH] docs: sync the shipped OIDC doc with the Entra manifest note The docs sync test pins frontend-modern/public/docs to the repo docs and 85136c582 only updated the repo copy, which broke Frontend CI on main. Refs #1635 --- frontend-modern/public/docs/OIDC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frontend-modern/public/docs/OIDC.md b/frontend-modern/public/docs/OIDC.md index a9ebf0027..31ad2d1f0 100644 --- a/frontend-modern/public/docs/OIDC.md +++ b/frontend-modern/public/docs/OIDC.md @@ -127,7 +127,7 @@ Create the provider in Pulse first (**Settings → Security → Single Sign-On - **Allowed Groups**: the group's Object ID (GUID), not its display name. - **Group Role Mappings**: `=admin`. Keying on the Object ID means the mapping survives a group rename in Entra. -> **Warning — group overage**: if a user belongs to more groups than Entra will fit in a token, Entra omits the `groups` claim entirely and sends a `_claim_names` / `_claim_sources` overage marker pointing at Microsoft Graph instead. Pulse does not follow that marker, so it sees the user as having no groups — and because a configured group-role mapping is authoritative, that login **clears** the user's role assignments instead of leaving them alone. Selecting **Groups assigned to the application** rather than **Security groups** in Token configuration keeps the claim small and avoids the overage. +> **Warning — group overage**: if a user belongs to more groups than Entra will fit in a token, Entra omits the `groups` claim entirely and sends a `_claim_names` / `_claim_sources` overage marker pointing at Microsoft Graph instead. Pulse does not follow that marker, so it sees the user as having no groups — and because a configured group-role mapping is authoritative, that login **clears** the user's role assignments instead of leaving them alone. Selecting **Groups assigned to the application** rather than **Security groups** in Token configuration keeps the claim small and avoids the overage. If the token still carries every security group after that, check the app registration **Manifest**: `groupMembershipClaims` must be exactly `"ApplicationGroup"`. A value like `"SecurityGroup, ApplicationGroup"` (left over from an earlier Token configuration choice) keeps emitting all security groups no matter what **Assignment required** is set to, so edit the manifest to drop `SecurityGroup`. > **Note**: Group-to-role mapping requires a Pro (or above) license. Plain SSO login and **Allowed Groups** gating work on any plan.