Splunk Cloud SSO Login Failure Due to Microsoft Entra ID Group Claim Configuration

Available Languages

Updated:November 4, 2026

Document ID:SPLK056047

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud

Description

Users attempting to access the Splunk Cloud environment through SAML SSO were receiving the error "SAML response does not contain group information." The behavior appeared isolated to specific accounts while other users continued to authenticate successfully.

Initial troubleshooting considered group membership limits, nested group inheritance, and SAML assertion content. Testing revealed differences between affected and unaffected users, leading to further review of the Microsoft Entra ID SAML configuration.

Investigation

1- Reviewed Splunk authentication logs and confirmed the failure was related to missing group information in the SAML response.
2- Validated that the SAML configuration in Splunk Cloud was functioning for other users.
3- Compared affected and unaffected user access patterns.
4- Investigated potential Microsoft Entra ID group membership limitations, including nested group memberships.
5- Reviewed internal guidance indicating Azure Entra ID supports up to 150 group memberships, including nested groups.
6- Confirmed the issue was not caused by a Splunk Cloud limitation.
7- Further analysis identified that the Microsoft Entra ID enterprise application was not configured to send the group information in the required format for authorization.
8- Verification performed by updating the SAML group claim configuration and assigning the required groups directly to the application.

Resolution

The issue was resolved by modifying the Microsoft Entra ID SAML group claim configuration and assigning the required groups to the Splunk Cloud enterprise application.

Configuration changes performed:

Access Microsoft Entra ID and navigate to Enterprise Applications.
Open the Splunk Cloud enterprise application.
Select Single Sign-On.
Open Attributes & Claims.
Edit the claim configured with the value user.groups.
Under Group Claims, select Groups assigned to the application.
Under Source Attribute, select Group ID.

After updating the claim configuration:

Return to the application overview page.
Select Users and Groups.
Assign the groups that require access to the Splunk Cloud application.

Following these changes, the SAML assertion properly included the required group information, allowing successful authentication and authorization. Access to the Splunk Cloud environment was restored for the affected users, and no further login issues were observed.