AD Group Mapping - Azure SAML Auth

Showing results for 
Show  only  | Search instead for 
Did you mean: 

AD Group Mapping - Azure SAML Auth

L0 Member

Any documentation on how to setup AD Group Mapping when using Azure AD SAML instead of LDAP as the authentication source. I did configure the LDAP servers and am using the long-name in the group policies but the policies aren't mapping the user to the AD group as I'd expect. 


L1 Bithead

I be interested as well.

L3 Networker

You can see the article from Okta and use it for Azure AD, you just need to find the Azure AD documentation how to set the atributes:

L1 Bithead

Hi There,

I arrived here to seek for answer to a problem that I could not find an answer to anywhere.

In fact, I still didn't find it but having access to lab, and some thought got me the desired result.


So what is it.

If you have setup a Security Web Policy based on LDAP Groups, and you authenticate using Kerberos/LDAP AD , PAN will identify you as domain\

You have some influence over how domain\ will look, but overall PAN will identify the user and will know groups you are a memeber of.

Now, you want to introduce AzureAD SAML authentication.

You found the article and followed it to the letter:

You were able to authenticate, and get connected so what's the problem?


The problem is that your user name is no longer domain\ but now it is , it is the account you have used to authenticate against Azure AD.

The user no longer matches any groups and the desired access for this user or group of users no longer works.


I found that the Attributes in the article  do not contain group attribute.




Under AzureAD Portal for Single-Sign on I've added the attribute then for Security Groups



Its under "Add a Group Claim"

Source Attribute: GroupID
Customize the name of the group claim: Group


All these is case sensitive(apparently)


Once you have the extra attribute, export the XML and Import to Palo.

Import it as Authentication Profile and add Group attribute you created:



When I log in using SAML now, I have different view:

The User: shows the email address I used to authenticate.

The Primary User name is domain\


Firewall can "match" the SAML account I used to the local AD.


Now, interesting part to some is the fact that I do not use Active Sync. My Local domain is entirely different to Azure AD. They are seperate.

I do have email attribute populated in my AD as the account I use with Azure though.

Hope this helps someone.
















L2 Linker

You do not need to add a group attribute, and it will not work for login control using groups. If you change the username attribute to match the settings below and have LDAP configured for userID Groups will work even for Prelogin. users will still login as before only the username submitted will be using local domain username format 🙂


It does not affect prelogin as no user credentials have b been processed yet. A typo on my part


Hi , Have you tried this in LAB and or in your environment, is it working and are you able user AD groups also on PA   

  • 6 replies
  • 62 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!