article Qlik Sense SaaS - Azure AD groups limitation per user in Official Support Articles

Qlik Sense SaaS - Azure AD groups limitation per user

Alexis_Touet — Mon, 03 Oct 2022 08:33:13 GMT

In larger organizations, the number of groups a user is a member of may exceed the limit that Azure Active Directory will add to a token. 150 groups for a SAML token, and 200 for a JWT.

Environment

Solution

Qlik Cloud does not read the groups into the ID token returned by Azure, but instead will fetch the groups for the user from the MS Graph API (a maximum of 1000 groups is fetched).

The groups are fetched from the following endpoint and nested groups are not supported.

https://docs.microsoft.com/en-us/graph/api/user-list-memberof

However, please note that if sending only specific groups to Qlik Sense is needed (and not all groups assigned to the user in Azure), then you will have to use the IdP type "ADFS" to read attributes from the ID token and use roles in Azure instead of groups to pass only the wanted groups.

https://joonasw.net/view/using-groups-vs-using-app-roles-in-azure-ad-apps

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

Re: Qlik Sense SaaS - Azure AD groups limitation per user

jmaynard — Thu, 06 Jan 2022 14:02:06 GMT

Do we have an idea if this is something Qlik will be solving in the future?

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Sonja_Bauernfeind — Wed, 12 Jan 2022 12:51:31 GMT

Hello @jmaynard

This is being worked on as an improvement, but we do not have an estimate on when.

Re: Qlik Sense SaaS - Azure AD groups limitation per user

hqx — Wed, 02 Mar 2022 07:45:14 GMT

Hi,

How does this limitation affecting hybrid deployment (on premises and Qlik Sense SaaS) with Azure AD in cloud and local AD configuration?

Is there a same limitation apply to on-premises AD?

Thank you!

James Wong

Re: Qlik Sense SaaS - Azure AD groups limitation per user

jmaynard — Wed, 02 Mar 2022 13:16:15 GMT

I created a case on the support site. We were informed a couple of weeks ago this was resolved.

Everything we have tested so far confirms that it is resolved.

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Damien_V — Mon, 03 Oct 2022 08:34:04 GMT

@jmaynard That is correct, this has now been updated with most recent information.

Re: Qlik Sense SaaS - Azure AD groups limitation per user

DavidFosterVF — Mon, 03 Oct 2022 10:32:00 GMT

@Damien_V what, specifically, has been updated?

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Damien_V — Tue, 04 Oct 2022 00:31:30 GMT

@DavidFosterVF

The initial limitation was 150-200 groups read from the ID token returned by Azure.

The current limitation is 1000 groups read from the Microsoft Graph API.

Reading from the Graph API also solves the issue that some Azure AD groups were coming in as guid instead of actual group names.

Re: Qlik Sense SaaS - Azure AD groups limitation per user

makunii — Thu, 02 Mar 2023 21:31:23 GMT

@Damien_V is it possible to list all groups from Qlik-Cli command?
I tried this command qlik.exe group ls but just listed 20 groups. How to list 1000 groups?

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Sonja_Bauernfeind — Fri, 03 Mar 2023 09:09:38 GMT

Hello @makunii

Please direct this question to our forum: Qlik Sense Integration, Extensions, and APIs. You will have access to a wider audience (support engineers, partners, and customers).

All the best,
Sonja

Re: Qlik Sense SaaS - Azure AD groups limitation per user

makunii — Fri, 03 Mar 2023 14:50:35 GMT

Hello @Sonja_Bauernfeind

Ok. I will.

Regards,

Marco

Re: Qlik Sense SaaS - Azure AD groups limitation per user

makunii — Fri, 03 Mar 2023 14:57:12 GMT

Hi @Damien_V

If my Azure AD has more than 1000 groups. How to import all of them?

Thank you

Marco

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Sonja_Bauernfeind — Wed, 08 Mar 2023 08:04:39 GMT

Hello @makunii

Please direct this question to our forum: Qlik Sense Integration, Extensions, and APIs. You will have access to a wider audience (support engineers, partners, and customers).

All the best,
Sonja

Re: Qlik Sense SaaS - Azure AD groups limitation per user

lilli_f — Thu, 23 May 2024 09:36:14 GMT

Hello all,

I see all our AD groups in Qlik, but I only want to see the ones that are related to Qlik.
Does anyone know how to fix that?

Thanks,
Lilli

Re: Qlik Sense SaaS - Azure AD groups limitation per user

janyf — Mon, 11 Nov 2024 15:52:34 GMT

Hello,

So this means that even when saml is used , groups are read from API ?

brgds

Jan Farkas

article Qlik Sense SaaS - Azure AD groups limitation per user in Official Support Articles

Qlik Sense SaaS - Azure AD groups limitation per user

Environment

Solution

Related Content

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Re: Qlik Sense SaaS - Azure AD groups limitation per user

Re: Qlik Sense SaaS - Azure AD groups limitation per user