Could not get Azure AD group name(s), please ensure your Azure AD app has sufficient Group API permissions with admin consent

[JoakimP]

Hi,

Following up my last post, (Solved: Re: Syncing guest from Azure with IdP to Qlik Sens... - Qlik Community - 2437674) with a new one.

We have our guest users syncing to Qlik Sense and have an assigned licens.
As soon as the user trys to login we get the following:

I have followed this guide, How To: Configure Qlik Sense Enterprise SaaS to us... - Qlik Community - 1704442 and read it up and down countless times and checkad the permissions for the apps in Azure AD.

The app registration have the correct permissions:

and if i check the enterprise app it has picked up these permissions:

If i go to  https://<tenanthostname>/api/v1/diagnose-claims or https://<tenanthostname>/api/v1/groups with the guest user, i get a 401

If i do the same with my user i get the correct reply with groups and information about my user.

Do anyone have any suggestions? 

Kind regards,
Joakim