# AzureAD user not member of one of the required groups

**URL:** <https://community.grafana.com/t/azuread-user-not-member-of-one-of-the-required-groups/103360>\
**Category:** Authentication\
**Created:** [September 12, 2023, 9:37am UTC](https://community.grafana.com/t/azuread-user-not-member-of-one-of-the-required-groups/103360 "2023-09-12T09:37:10Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![nebojsacekic](https://avatars.discourse-cdn.com/v4/letter/n/c4cdca/32.png) [@nebojsacekic](https://community.grafana.com/u/nebojsacekic)\
**Post date:** [September 12, 2023, 9:37am UTC](https://community.grafana.com/t/azuread-user-not-member-of-one-of-the-required-groups/103360/1 "2023-09-12T09:37:10Z")

</div>

Hello Community,

i have read some reports here regarding the same error which is receive but didnt found the solution for me. Hopefully anyone of you can help.

I have configured in Azure the App for my Grafana instance to use openID Connect. The configs of the Azure App are as follows:  
Authentication =\> WEB  
Certificates and Secrets =\> Secret has been created  
Token configuration =\> email (token type: ID), family\_name (token type: ID), given\_name (token type: ID), groups (token type: ID)  
API Permissions =\> i have added over “own API” the group for my app “Grafana Org Admin” which is also configured as allowed\_groups. And under API Permissions i also habe the Microsoft Graph: email, openid, profile, user.read  
App Roles: Grafana Org Admin, Grafana Viewer, Grafana Editor (in all of those groups i have put my user inside) and the group IDs are the same like in the manifest file:  
[manifest.txt](https://github.com/grafana/grafana/files/12583987/manifest.txt)

And this is my grafana configuration:  
name: Grafana OIDC Login  
enabled: true  
allow\_sign\_up: false  
client\_id: “((GF\_AUTH\_AZUREAD\_CLIENT\_ID))”  
client\_secret: “((GF\_AUTH\_AZUREAD\_CLIENT\_SECRET))”  
scopes: openid email profile  
auth\_url: …login.microsoftonline.com/ID/oauth2/v2.0/authorize  
token\_url: …login.microsoftonline.com/ID/oauth2/v2.0/token  
allowed\_groups: 751f9983-973e-49c9-bab0-82296f261f46, 634287bc-ecec-4245-9085-47112c29ccef,  
allowed\_domains: company\_domain  
allow\_assign\_grafana\_admin: false  
use\_pkce: false  
auto\_login: false  
force\_use\_graph\_api: false  
role\_attribute\_strict: true

And this i get when i access grafana :  
logger=context userId=0 orgId=0 uname= t=2023-09-12T07:57:08.236193222Z level=error msg=“login.OAuthLogin(get info from azuread)” error=“user not a member of one of the required groups”  
logger=context userId=0 orgId=0 uname= t=2023-09-12T07:57:08.236831308Z level=error msg=“Request Completed” method=GET path=/login/azuread status=500 remote\_addr=11.237.100.254 time\_ms=312 duration=312.365498ms size=1366 referer=[https://login.microsoftonline.com/](https://login.microsoftonline.com/) handler=/login/:name  
logger=cleanup t=2023-09-12T08:02:02.977677253Z level=info msg=“Completed cleanup jobs” duration=20.807658ms

MANIFEST FILE OF THE AZURE APP:

```auto
{
	"id": "13c2b65a-48a2-4413-97e9-4251af8abdf2",
	"acceptMappedClaims": true,
	"accessTokenAcceptedVersion": 2,
	"addIns": [],
	"allowPublicClient": null,
	"appId": "oopkmba0f-b01a-485f-abc7-09833378890
	"appRoles": [
		{
			"allowedMemberTypes": [
				"User",
				"Application"
			],
			"description": "Grafana org admin Users",
			"displayName": "Grafana Org Admin",
			"id": 005588837463-973e-49c9-bab0-89077652109663",
			"isEnabled": true,
			"lang": null,
			"origin": "Application",
			"value": "Admin"
		},
		{
			"allowedMemberTypes": [
				"User"
			],
			"description": "Grafana read only Users",
			"displayName": "Grafana Viewer",
			"id": "nm78044-ecec-4245-9085-47112c29ccef",
			"isEnabled": true,
			"lang": null,
			"origin": "Application",
			"value": "Viewer"
		},
		{
			"allowedMemberTypes": [
				"User"
			],
			"description": "Grafana Editor Users",
			"displayName": "Grafana Editor",
			"id": "7659f705-8a18-450e-a792-187b3dd41b71",
			"isEnabled": true,
			"lang": null,
			"origin": "Application",
			"value": "Editor"
		}
	],
	"oauth2AllowUrlPathMatching": false,
	"createdDateTime": "2023-09-11T08:28:27Z",
	"description": null,
	"certification": null,
	"disabledByMicrosoftStatus": null,
	"groupMembershipClaims": "ApplicationGroup",
	"identifierUris": [
		"api://dd62ba0f-b01a-485f-abc7-3b1c77e6d211"
	],
	"informationalUrls": {
		"termsOfService": null,
		"support": null,
		"privacy": null,
		"marketing": null
	},
	"keyCredentials": [],
	"knownClientApplications": [],
	"logoUrl": "https://aadcdn.msftauthimages.net/c1c6b6c8-ycx7a3djlnzlid7udaicyih8i3zhlsvubj48la5r5yc/appbranding/mjodpclawp8-fqzrz778vqpdqrtgmufalbbrubq5b1c/1033/bannerlogo?ts=638300190135136287",
	"logoutUrl": null,
	"name": "Grafana",
	"notes": null,
	"oauth2AllowIdTokenImplicitFlow": false,
	"oauth2AllowImplicitFlow": false,
	"oauth2Permissions": [
		{
			"adminConsentDescription": "lesen",
			"adminConsentDisplayName": "lesen",
			"id": "4df0b83d-d76a-4bb0-b93e-40f7f9239455",
			"isEnabled": false,
			"lang": null,
			"origin": "Application",
			"type": "User",
			"userConsentDescription": null,
			"userConsentDisplayName": null,
			"value": "Files.Read-all"
		},
		{
			"adminConsentDescription": "Admin Read ",
			"adminConsentDisplayName": "Benutzerdateien lesen",
			"id": "ee299f7c-3799-4f1c-a544-553151c7c6d6",
			"isEnabled": true,
			"lang": null,
			"origin": "Application",
			"type": "Admin",
			"userConsentDescription": null,
			"userConsentDisplayName": null,
			"value": "Files.Read"
		}
	],
	"oauth2RequirePostResponse": false,
	"optionalClaims": {
		"idToken": [
			{
				"name": "email",
				"source": null,
				"essential": false,
				"additionalProperties": []
			},
			{
				"name": "family_name",
				"source": null,
				"essential": false,
				"additionalProperties": []
			},
			{
				"name": "given_name",
				"source": null,
				"essential": false,
				"additionalProperties": []
			},
			{
				"name": "groups",
				"source": null,
				"essential": false,
				"additionalProperties": []
			}
		],
		"accessToken": [
			{
				"name": "groups",
				"source": null,
				"essential": false,
				"additionalProperties": []
			}
		],
		"saml2Token": [
			{
				"name": "groups",
				"source": null,
				"essential": false,
				"additionalProperties": []
			}
		]
	},
	"orgRestrictions": [],
	"parentalControlSettings": {
		"countriesBlockedForMinors": [],
		"legalAgeGroupRule": "Allow"
	},
	"passwordCredentials": [
		{
			"customKeyIdentifier": null,
			"endDate": "2025-09-10T08:29:58.861Z",
			"keyId": "5576949d-ae55-4070-a499-c5564ed432b4",
			"startDate": "2023-09-11T08:29:58.861Z",
			"value": null,
			"createdOn": "2023-09-11T08:30:12.6739349Z",
			"hint": "Zt4",
			"displayName": "Grafana oauth"
		}
	],
	"preAuthorizedApplications": [],
	"publisherDomain": "company.onmicrosoft.com",
	"replyUrlsWithType": [
		{
			"url": "https://grafana-domain/login/azuread",
			"type": "Web"
		},
		{
			"url": "https://grafana-domain",
			"type": "Web"
		}
	],
	"requiredResourceAccess": [
		{
			"resourceAppId": "dd62ba0f-b01a-485f-abc7-3b1c77e6d211",
			"resourceAccess": [
				{
					"id": "751f9983-973e-49c9-bab0-82296f261f46",
					"type": "Role"
				}
			]
		},
		{
			"resourceAppId": "00000003-0000-0000-c000-000000000000",
			"resourceAccess": [
				{
					"id": "14dad69e-099b-42c9-810b-d002981feec1",
					"type": "Scope"
				},
				{
					"id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d",
					"type": "Scope"
				},
				{
					"id": "37f7f235-527c-4136-accd-4a02d197296e",
					"type": "Scope"
				},
				{
					"id": "64a6cdd6-aab1-4aaf-94b8-3cc8405e90d0",
					"type": "Scope"
				}
			]
		}
	],
	"samlMetadataUrl": null,
	"signInUrl": null,
	"signInAudience": "AzureADMyOrg",
	"tags": [
		"apiConsumer",
		"webApp"
	],
	"tokenEncryptionKeyId": null
}

```