When you try to enable SSO for your Aura instances access, if the list of groups is too long to fit into an access token in an Azure Active Directory (Azure AD) application, you may encounter token size limitations. Access tokens are used to represent a user's identity and access rights, and they have a maximum size limitation. When dealing with a large number of groups, the token may become too large to be practical or the groups may be omitted at the source in Azure.

 

Here's a detailed, step-by-step guide on how to handle this type of scenario.

1. Change the groups assigned to the application, select the application from the Enterprise applications list. Select Users and Groups and then Add user/group. Select the Neo4j Aura related group(s) you want to add to the application from Users and Groups.
2. Select Azure AD -> Application Registrations -> "your Aura SSO application" -> Token configurations and edit your groups claim as in the screenshot below:
   
   
   
   
3. Verify that your groups list in the access token is only returning the assigned groups

You may see another behaviour whereby the groups claim is displayed as a hyperlink instead of groups, please see the following article for more information: 

Why is my groups claim only showing "_claim_sources" in my Aura SSO OIDC Token

 

For more articles relating to the configuration and troubleshooting of SSO, please see the follow page: Article Directory: Aura SSO Configuration and Troubleshooting