SAML using Azure AD as the IdP is not working

Available Languages

Updated:September 29, 2026
Document ID:SPLK046457

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud Microsoft’s Azure SAML Single Sign On (SSO)

Description

After completing the setup for the Azure SSO using the steps provide in Configuring Microsoft’s Azure SAML Single Sign On (SSO) with Splunk Cloud – Using the 'New' Azure Portal

The specific error reply is: 
AADSTS50105: Your administrator has configured the application Azure AD SSO for Splunk Enterprise and Splunk Cloud ('here it will display the group ID') to block users unless they are specifically granted ('assigned') access to the application. The signed in user 'test02' is blocked because they are not a direct member of a group with access, nor had access directly assigned by an administrator. Please contact your administrator to assign access to this application.

Investigation

This happens due to "The user hasn't been granted access to the application in Azure AD. The user must belong to a group that is assigned to the application, or be assigned directly."

 See full details on the link below: 
Error AADSTS50105 - The signed in user is not assigned to a role for the application
 

Resolution

When configuring Microsoft’s Azure SAML , Referrer to the step 7, due the main issues noticed are that the group ID mapped within Splunk does not match the one with Azure.
7.   After the “Splunk Enterprise and Splunk Cloud” installation completes, you are brought back to the "Splunk Enterprise and Splunk Cloud – Quick start" panel.
a.    Click "Assign a user for testing (required)" in the right panel. The “Users and Groups” panel displays. And make sure the settings are correct.

Once here be careful, due the error can be deceiving, because, it will returned a message like this: 
“signed in user ' test02' is blocked because they are not a direct member of a group with access, nor had access directly assigned by an administrator”.
If after configuring the steps above the issue persist, this can be because:
The user in Azure AD might exist within 2 instances, One with a user principal name of “test01” and another with a user principal name of “test02”.
The group assigned to the SSO App had the “test01'' in it, and both users have the same email address of test01@microsoft.com.

Make sure the user principal name and email address are not using the same email address  within “Azure Active Directory”, due it will cause mapping issues, therefore errors will be present.
 

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products