Mapping Entra groups to role collections: the Identity Federation trap

Why it's worth reading

At sign-in, Microsoft Entra ID is generous with groups. Very generous. Some SAP applications then turn those groups into role collections. So how do you filter what actually arrives in Identity Authentication? The discussion reaches a conclusion with consequences: the attributes can only be controlled once Identity Federation is switched on for the corporate IdP, and that affects the user store.

Mapping groups to roles is everyday project work. Few people know the Identity Federation trap, and most of them found out the hard way.