Azure/Entra ID - Failing group mapping

Available Languages

Updated:October 1, 2026

Document ID:SPLK052828

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud, Splunk Enterprise, SAML

Description

Azure/Entra ID is unable to parse the group attribute from assertion. Returns 'No value found in SamlResponse for match key'. This will likely trigger a 'Failed to decode relayState.' when login attempts fail.

Investigation

Most important clue can be encountered on 'splunkd.log'. This issue triggers the following message:

10-11-2025 00:00:00.000 +0000 ERROR Saml [46532 webui] - No value found in SamlResponse for match key=saml:AttributeStatement/saml:Attribute attrName=role err=No nodes found for xpath=saml:AttributeStatement/saml:Attribute

This message is related on how Azure/Entra/ADFS send SAML attributes on the XML responses. In other words, Splunk is unable to identify how the group/role attribute is named and will require an alias to fix.

Resolution

In most scenarios, adding the following aliases fix the issue:

Role alias: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
RealName alias: http://schemas.microsoft.com/identity/claims/displayname
Mail alias: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress