Azure AD: Enterprise apps, assigning group for access to app not working

[IT_Man_Dan]

Morning all,

 

I've recently setup azure authentication for roombookingsystem by creating an enterprise app in Azure AD.

When I assign a individual user to the app the authentication works fine.

 

When I assign a security group containing 150 users no one can authenticate and it the following error message:

AADSTS50105: The signed in user 'username' is not assigned to a role for the application '589cc895-a0bd-4c70-bc15-b21c2c4e67a8'(Room Booking System).

 

Any ideas on what I'm doing wrong?

 

Many thanks

[manc_techie]

Hi,

 

Do you need to assign a role within the application e.g. Object "Group" maps to Role Assigned "User" or do you need to provision the user within the AD application to create within Room Booking? Not a system I've used but have a fair few apps setup to either autoprovision or map groups.

[IT_Man_Dan]

Hi,

 

Do you need to assign a role within the application e.g. Object "Group" maps to Role Assigned "User" or do you need to provision the user within the AD application to create within Room Booking? Not a system I've used but have a fair few apps setup to either autoprovision or map groups.

[ATTACH=CONFIG]62946[/ATTACH]

 

Thanks for your reply.

The group in question has been added to the group and assigned user role.

I did exactly this for a specific user and it works fine, just not when I add the group sadly.

[TechMonkey]

Is that group a group of direct users or a group of groups? I have found Azure has always hated nested groups, which is annoying as we use nested groups a lot to save on adding users to many groups.

[IT_Man_Dan]

Is that group a group of direct users or a group of groups? I have found Azure has always hated nested groups, which is annoying as we use nested groups a lot to save on adding users to many groups.

 

It's a group of direct users.

Could it maybe take a few hours for the setting to take affect when assigning a group? I assigned it this morning but have since unassigned and re assigned it whilst trying to fix the issue.

 

Could I be lucky and find it works tomorrow? wishful thinking I guess.