# Kibana oidc (azure) role assignment not working (too many groups)
**URL:** https://discuss.elastic.co/t/kibana-oidc-azure-role-assignment-not-working-too-many-groups/350568
**Category:** Kibana
**Tags:** elastic-stack-security
**Created:** [January 8, 2024, 10:39am UTC](https://discuss.elastic.co/t/kibana-oidc-azure-role-assignment-not-working-too-many-groups/350568 "2024-01-08T10:39:20Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@rafi0101](https://discuss.elastic.co/u/rafi0101)
#### Post date: [January 8, 2024, 10:39am UTC](https://discuss.elastic.co/t/kibana-oidc-azure-role-assignment-not-working-too-many-groups/350568/1 "2024-01-08T10:39:20Z")
I am using Kibana/Elasticsearch with Oidc (Microsoft Azure) for authentication.
Currently I have the problem that not all defined role mappings are working correctly.
We are using Azure groups in role mappings to assign users to specific Kibana roles.
9 out of 10 users can log in and work without any problems. However, user 10 is problematic. Some users in our organization are in many AD groups \>250
And then the JWT token in the groups section is empty and points to another endpoint to retrieve all groups this user is assigned to.
> Microsoft Entra ID limits the number of groups that it will emit in a token to 150 for SAML assertions and 200 for JWT. If a user is a member of a larger number of groups, the groups are omitted. A link to the Microsoft Graph endpoint to obtain group information is included instead.
> [https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims#options-for-applications-to-consume-group-information](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims#options-for-applications-to-consume-group-information)
And I think Kibana does nothing with this information and thinks this user is not a member of any group.
I have also addressed this as a support case but almost a year later nothing happenend: #01312479 (5008X00002J8locQAB)
---
### Author:  [@tsullivan](https://discuss.elastic.co/u/tsullivan)
#### Post date: [January 19, 2024, 8:39pm UTC](https://discuss.elastic.co/t/kibana-oidc-azure-role-assignment-not-working-too-many-groups/350568/2 "2024-01-19T20:39:56Z")
This sounds like a possible bug in the Elasticsearch modules for role mapping.
To get the proper attention on this, I would recommend filing an issue in the Elasticsearch code repository: [Sign in to GitHub · GitHub](https://github.com/elastic/elasticsearch/issues/new)
It may help to provide the declaration of your oidc realm as configured in elasticsearch.yml.
---
### Author:  [@rafi0101](https://discuss.elastic.co/u/rafi0101)
#### Post date: [February 2, 2024, 12:15pm UTC](https://discuss.elastic.co/t/kibana-oidc-azure-role-assignment-not-working-too-many-groups/350568/3 "2024-02-02T12:15:11Z")
Thanks, I created an issue: [Kibana oidc (azure) role assignment not working (too many groups) · Issue #105058 · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/issues/105058)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 1, 2024, 12:15pm UTC](https://discuss.elastic.co/t/kibana-oidc-azure-role-assignment-not-working-too-many-groups/350568/4 "2024-03-01T12:15:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.