# Forbidden error when connnecting after setting up SAML on Elastic Cloud **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [May 25, 2020, 11:23am UTC](https://discuss.elastic.co/t/forbidden-error-when-connnecting-after-setting-up-saml-on-elastic-cloud/234140 "2020-05-25T11:23:58Z")\ **Posts on this page:** 1\ **Showing post:** 5
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [May 25, 2020, 2:56pm UTC](https://discuss.elastic.co/t/forbidden-error-when-connnecting-after-setting-up-saml-on-elastic-cloud/234140/5 "2020-05-25T14:56:20Z")
> [@Yannis\_Psarras](#): > > But it doesnt seem this is coming through Yes, this does seem to be the issue here. I have no working knowledge of Azure AD but a simple search lead me to [Configure group claims for applications by using Microsoft Entra ID | Microsoft Learn](https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-group-claims) which seems to describe how to release Security Groups from your azure AD in the `http://schemas.microsoft.com/ws/2008/06/identity/claims/role` claim ( == SAML Attribute in our case) , hope this helps. > P.S. Really helpful to have a blog there detailing most of the steps but I do feel it's quite outdated. If you try to follow it you will see what I mean. Just my 2c. Thanks for the feedback, we do appreciate this. Ping @forloop who wrote the original blog post to see if it would make sense to update some parts. Speaking of which, @forloop [wrote another excellent guide recently](https://discuss.elastic.co/t/sso-azure-ad-setup/230639/2) in the forums that might help you too. --- _[View the full topic](https://discuss.elastic.co/t/forbidden-error-when-connnecting-after-setting-up-saml-on-elastic-cloud/234140)._