Azure AD user groups mapped to one or more roles

Question

Is it possible to have multiple roles when using Azure AD for federated authentication to the CMS? Currently testing this with Sitecore 9.3.

I want to be able to assign to the AD user either Public Web Author or Public Web Author + Developer. However Sitecore only seems to pick one of the roles.

Identity server:

<Sitecore>
  <ExternalIdentityProviders>
    <IdentityProviders>
      <AzureAd>
        <ClaimsTransformations>
          <AzureGroupTransformation type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
            <SourceClaims>
              <Claim1 type="groups" value="76a85c07-e51f-4c87-8568-3e21dc3b9dce" />
            </SourceClaims>
            <NewClaims>
              <Claim1 type="role" value="sitecore\Public Web Author" />
            </NewClaims>
          </AzureGroupTransformation>
          <AzureGroupTransformation type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
            <SourceClaims>
              <Claim1 type="groups" value="3064fb35-e2b9-4f9a-bdf7-7280e319fc52" />
            </SourceClaims>
            <NewClaims>
              <Claim1 type="role" value="sitecore\Developer" />
            </NewClaims>
          </AzureGroupTransformation>
          <AzureADUserToAdminUser type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
            <SourceClaims>
              <Claim1 type="groups" value="8af5e84c-d1f1-4f44-9a46-e168e197b0dc" /> 
            </SourceClaims>
            <NewClaims>
              <Claim1 type="http://www.sitecore.net/identity/claims/isAdmin" value="true"/>
            </NewClaims>
          </AzureADUserToAdminUser>
        </ClaimsTransformations>
      </AzureAd>
    </IdentityProviders>
  </ExternalIdentityProviders>
</Sitecore>

Answer 1

I have a different scenario where I use 2 Azure AD groups to claim a single Sitecore Role, and it look like this

<AzureADToAuthor type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders" >
     <SourceClaims>
     <!-- Group 1 -->
          <Claim1 type="groups" value="d8aa7404-cc24-46dc-a66d-013cf52384e9" />
     <!-- Group 2 -->
          <Claim2 type="groups" value="d4215556-b598-4b1f-acd7-c9dfc52ccc61" />
     </SourceClaims>
     <NewClaims>
          <Claim1 type="role" value="Sitecore\Author" />
     </NewClaims> </AzureADToAuthor>

And I believe here is how you should do it in your case, and claim 2 Sitecore Roles instead

<AzureADToDevAuthor type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders" >
   <SourceClaims>
      <Claim1 type="groups" value="d8aa7404-cc24-46dc-a66d-013cf52384e9" />
   </SourceClaims>
   <NewClaims>
      <Claim1 type="role" value="sitecore\Public Web Author" />
      <Claim2 type="role" value="sitecore\Developer" />
   </NewClaims>
</AzureADToDevAuthor>

Answer 2

On the documentation there are the following items:

When you configure and use Azure AD with the Sitecore Identity server, you have to remember:

1. Check the ID tokens checkbox in the Advanced Settings in the Web - Authentication tab in the application registration.

2. Set the value of the groupMembershipClaims setting in the application manifest to SecurityGroup.

3. You can only configure replyUrls in the legacy version of the application registration. Use replyUrlsWithType instead.

We had not done number 2 - it was set to "All", so updated this, and also:

Do not add multiple nodes with the same name. If you need multiple nodes, name the nodes AzureGroupTransformation1, AzureGroupTransformation2, and so forth.

We had not done this. Updating these two changes resolved it.