Microsoft Entra ID User Log in Fails in VCF 9 with "Failed to Log In with VCF SSO Service" When Using Group Pre-Provisioning

Products

• VCF Operations

Issue/Introduction

• When configuring VMware Identity Broker integration with Microsoft Entra ID using OIDC for SSO in VCF 9, users may encounter the following error during log in when using Just-In-Time (JIT) provisioning and group pre-provisioning: 
  "Failed to log in with VCF SSO service. The user did not import or does not belong to any imported group."
  
  
• Reviewing /storage/log/vcops/log/analytics-<ID>.log in VCF Operations, following entries are reported:
  YYYY-MM-DD ERROR analytics 25928 [ops@4413 threadId="###" threadName="ServerConnection on port ### Thread 16"] [com.vmware.vcops.auth.server.UserAuthenticationServer.handleAuthenticationFail] - UserAuthException during log in: userId ######-####-####-#########, username <email_ID>
com.vmware.vcops.auth.exception.UserAuthException: User does not have any role to log in to system
at com.vmware.vcops.auth.server.UserAuthenticationServer. createUserSession (UserAuthenticationServer. java : 749) ~[vcops-auth-server-1. 0-SNAPSHOT. jar : ?]

Environment

• VMware Cloud Foundation(VCF) 9
• Microsoft EntraID using OIDC

Cause

• The issue occurs when the pre-provisioned group configured in VCF 9 is a Microsoft Entra ID cloud-only group (Group Source: Cloud) that was created directly in the Entra portal and is not synchronized from an on-premises Active Directory.
• When Microsoft Entra ID is configured to emit group claims as Display Names, SamAccountNames, or NetBIOS names, cloud-only groups are not included in the OIDC token because these attributes are only available for on-premises AD-synchronized (hybrid) groups. Consequently, the OIDC token presented to VMware Identity Broker (VIDB) contains empty group claims, which can be verified by decoding the token.
  Example:
"group_names": [],
"group_ids": []
• VIDB's group pre-provisioning workflow relies on group claims within the OIDC token to map the authenticated user to a pre-provisioned group. Since the token does not contain the cloud-only group membership information, VIDB is unable to associate the user with the configured pre-provisioned group. As a result, the VIDB-issued JWT does not include the required group memberships, preventing VCF Operations from identifying any valid entitlements for the user and causing the log in attempt to fail.

Resolution

To ensure that Microsoft Entra ID includes cloud-only group memberships in the OIDC ID token, update the App Registration manifest to emit group claims using cloud display names.

1. Log in to the Microsoft Entra Admin Center.
2. Navigate to Applications > App registrations.
3. Select the application used for VCF authentication.
4. In the left navigation pane, select Manifest.
5. In the Manifest editor, locate the groupMembershipClaims property and change its value to "ApplicationGroup". This ensures only groups that are explicitly assigned to this application are included in the token.
6. In the same Manifest, find the optionalClaims section. Under both the idToken and accessToken entries for the groups claim, add "cloud_displayname" to the additionalProperties list. This tells Entra to include the display name of cloud-only groups in the token. Refer: Configure the Microsoft Entra application registration for group attributes
7. Click Save to apply the manifest changes.
8. Assign the cloud-only security group to the Enterprise Application:
   1. In the Entra Admin Center, navigate to Enterprise Applications.
   2. Select the same application used for VCF authentication.
   3. In the left navigation pane, select Users and Groups.
   4. Click Add assignment and assign the cloud-only security group that is pre-provisioned in VCF Operations.
      Note: This step is required because ApplicationGroup (set in Step 5) only emits groups that are explicitly assigned here. Any group not assigned to the application will not appear in the token.
9. Sign out of VCF and initiate a new login to generate a fresh OIDC token.
10. Decode the token (using a tool such as jwt.ms) and verify that group_names contains the expected cloud group display name in both the Entra-issued ID token and access token. 

After the manifest is updated, Microsoft Entra ID includes the cloud-only group's display name in the OIDC token. VIDB can then match the authenticated user to the configured pre-provisioned group, resulting in the appropriate group memberships being included in the VIDB-issued JWT and allowing successful authentication to VCF Operations.