Permission denied after configuring SAML with Entra Azure and Identity Broker

Products

VCF Operations VMware NSX VMware vCenter Server

Issue/Introduction

After configuring Microsoft Entra ID as an Identity Provider using SAML in VCF Operations > Identity & Access, and then adding imported groups in NSX in System > User Management > User Role Assignment, users within those groups cannot log in to NSX and get the following error:
```
Access Denied. You are not authorized to perform this operations. Please check your permissions.
```
After successfully configuring an Azure Application Proxy to allow Entra ID using SCIM to communication with VCF Operations and vCenter , users get "Access Denied" when attempting to login
Users may continue to receive "Access Denied" even after validating SAML claims.

Review the Identity Broker logs at the following path to confirm a identity mismatch: ./vidb-mgmt-#####/vidb-service-################/vidb-service/console-log-##########.log

com.vmware.vidm.federation.login.processor.AuthResponseUserResolver - Fetching user for jit login context: [GUID] on attribute userName=#######@example.com, domains: [example.com]
com.vmware.vidm.federation.login.processor.AuthResponseUserResolver - User fetching exception with nameId #######@example.com, nameIdFormat userName, and domains [example.com], user not found

Environment

VCF Operations 9.0.x
VCF Identity Broker 9.0.x (external appliance)
vCenter Server 9.0.x
NSX 4.x

Cause

This issue occurs because the Entra configuration is missing the required claims for the domain, username, group, and email. All required claims must be present in Entra for authentication to function properly when configured with VCF Operations Identity Broker.
If using SCIM for user and group provisioning with SAML 2.0 as the authentication protocol:

There can be an identity string mismatch between the Authentication Token (SAML/OIDC claims) and the SCIM Provisioning data stored in the Identity Broker database. Successful authentication requires a strict 1:1 match between these two sources.
The mismatch typically occurs in one of two ways:
1. The Entra ID authentication token is sending a modified string (e.g., UPN suffix stripped) that does not match the full UPN stored in the database.
2. The SCIM provisioning agent is configured to map the userName target to an incorrect Entra attribute (e.g., extensionAttribute2), populating the database with data that does not match the UPN claim sent in the login token.

Resolution

To resolve this issue, you must configure the missing claims within your Entra Enterprise Application settings:

Important for SCIM Users: If your application uses SCIM for provisioning, you must also verify your Attribute Mappings are set properly

In Entra, open Enterprise Applications.
Select the application configured for use with Identity Broker.
Navigate to the Single Sign-On configuration, and then select User Attributes & Claims.
Add a new claim domain:
- Name: domain
- Source: Transformation
- Manage transformation:
  - Transformation: Extract() , select After matching
  - Parameter 1 (Input): Attribute
  - Attribute name: user.userprincipalname
  - Value: @
Add a new claim userName:
- Name: userName
- Source: Transformation
- Manage transformation:
  - Transformation: Extract() , select Before matching
  - Parameter 1 (Input): Attribute
  - Attribute name: user.userprincipalname
  - Value: @
Add a new claim email:
- Name: email
- Source: Attribute
- Source attribute: user.mail
Add a group claim:
- Select All Groups
- Source attribute: sAMAccountName
- Select Customize the name of the group claim
- Name (required): groups

Additional Check: SCIM Agent Attribute Mapping

If the Single Sign-On configuration for Attributes & Claims is already set like above and VCF SSO logins still fail, ensure the SCIM Provisioning agent is pushing the matching attribute(s):

Log in to the Microsoft Entra ID portal.
Navigate to Enterprise Applications > [Your SCIM Application] > Attribute Mappings.
Locate the mapping for the target attribute (i.e. userName ), which may be labeled as AgentBasedScim Attribue
Ensure this is set to userPrincipalName (or the attribute that matches your SAML userName claim). This may be labeled as Microsoft Entra ID Attribute
Save the changes.

Note: It may take 40–60 minutes for Microsoft Entra ID to complete the automated provisioning cycle and update the VCF Identity Broker database. Authentication will continue to fail until the next synchronization cycle successfully patches the corrected identities.

Additional Information

Note: This configuration is not specific for use with NSX but is always required when configuring Microsoft Entra ID using SAML.