# User Management based on Azure AD Groups **URL:** \ **Category:** Get Help\ **Tags:** azure, collections, awx\ **Created:** [November 27, 2023, 11:10pm UTC](https://forum.ansible.com/t/user-management-based-on-azure-ad-groups/2602 "2023-11-27T23:10:09Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![fhomess](https://avatars.discourse-cdn.com/v4/letter/f/d9b06d/32.png) [@fhomess](https://forum.ansible.com/u/fhomess)\ **Post date:** [November 27, 2023, 11:10pm UTC](https://forum.ansible.com/t/user-management-based-on-azure-ad-groups/2602/1 "2023-11-27T23:10:09Z")
I’m sure I’m missing something incredibly obvious, but I’m struggling to see what it is and hoping someone here can assist. We have an integration with Azure AD for user authentication. I would like users to be added to teams and organizations based on their Azure AD security group rather than having to add them as individuals. When I go to the documentation I only see an ability to add users based on their account identifier (emails in the example): [18. Setting up Social Authentication — Automation Controller Administration Guide v4.0.0 (ansible.com)](https://docs.ansible.com/automation-controller/4.0.0/html/administration/social_auth.html#ag-org-team-maps) Is there something I can put in the admin/users field other than their direct login to tell it to check the user’s group membership and add them based on that? A regex on the user’s account identifier will not work as there’s nothing there that would assist in mapping to group membership. Thanks! ---
**Author:** ![cmalarick15](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/cmalarick15/32/5278_2.png) [@cmalarick15](https://forum.ansible.com/u/cmalarick15)\ **Post date:** [October 28, 2024, 8:16pm UTC](https://forum.ansible.com/t/user-management-based-on-azure-ad-groups/2602/2 "2024-10-28T20:16:12Z")
@fhomess Did you ever figure this out, I am running into the same issue and can’t seem to get the org/teams to map to the members of the AzureAD group. ---
**Author:** ![fhomess](https://avatars.discourse-cdn.com/v4/letter/f/d9b06d/32.png) [@fhomess](https://forum.ansible.com/u/fhomess)\ **Post date:** [October 29, 2024, 3:18am UTC](https://forum.ansible.com/t/user-management-based-on-azure-ad-groups/2602/3 "2024-10-29T03:18:28Z")
I did not, unfortunately. ---
**Author:** ![jiholland](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jiholland/32/11273_2.png) [@jiholland](https://forum.ansible.com/u/jiholland)\ **Post date:** [October 29, 2024, 9:01am UTC](https://forum.ansible.com/t/user-management-based-on-azure-ad-groups/2602/4 "2024-10-29T09:01:16Z")
You can do this with [LDAP](https://docs.ansible.com/automation-controller/latest/html/administration/ldap_auth.html), but it does not look like it is possible with Azure AD. ---
**Author:** ![cmalarick15](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/cmalarick15/32/5278_2.png) [@cmalarick15](https://forum.ansible.com/u/cmalarick15)\ **Post date:** [October 29, 2024, 11:28am UTC](https://forum.ansible.com/t/user-management-based-on-azure-ad-groups/2602/5 "2024-10-29T11:28:58Z")
@fhomess Before I go the route of SAML, are you using the AzureAD with Oauth or SAML? @jiholland unfortunately in our environment the enterprise is pushing AzureAD to move away from LDAP. ---
**Author:** ![fhomess](https://avatars.discourse-cdn.com/v4/letter/f/d9b06d/32.png) [@fhomess](https://forum.ansible.com/u/fhomess)\ **Post date:** [October 29, 2024, 5:06pm UTC](https://forum.ansible.com/t/user-management-based-on-azure-ad-groups/2602/6 "2024-10-29T17:06:29Z")
@cmalarick15 We’re using AzureAD with Oauth. ---
**Author:** ![cmalarick15](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/cmalarick15/32/5278_2.png) [@cmalarick15](https://forum.ansible.com/u/cmalarick15)\ **Post date:** [October 29, 2024, 6:49pm UTC](https://forum.ansible.com/t/user-management-based-on-azure-ad-groups/2602/7 "2024-10-29T18:49:51Z")
@fhomess are you still manually adding each user or is there another method? I am working with my internal SSO team to see if we have any other options but we seem to be striking out as of now. ---
**Author:** ![jiholland](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jiholland/32/11273_2.png) [@jiholland](https://forum.ansible.com/u/jiholland)\ **Post date:** [October 29, 2024, 7:15pm UTC](https://forum.ansible.com/t/user-management-based-on-azure-ad-groups/2602/8 "2024-10-29T19:15:48Z")
Why not use the API? [awx.awx.user module – create, update, or destroy Automation Platform Controller users. — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/collections/awx/awx/user_module.html#ansible-collections-awx-awx-user-module) ---
**Author:** ![Karen\_Lopez](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/karen_lopez/32/7035_2.png) [@Karen\_Lopez](https://forum.ansible.com/u/Karen_Lopez)\ **Post date:** [February 5, 2025, 1:10am UTC](https://forum.ansible.com/t/user-management-based-on-azure-ad-groups/2602/9 "2025-02-05T01:10:41Z")
Hello, new to the forum…Setting up SSO on most of our tools… Setting up Azure AD with our Ansible AWX… Got most setting correct but getting AADSTS900971: No reply address provided. It says got the wrong redirect URI… just not sure where to check. Thanks ---
**Author:** ![ildjarn](https://avatars.discourse-cdn.com/v4/letter/i/8491ac/32.png) [@ildjarn](https://forum.ansible.com/u/ildjarn)\ **Post date:** [February 5, 2025, 12:46pm UTC](https://forum.ansible.com/t/user-management-based-on-azure-ad-groups/2602/10 "2025-02-05T12:46:43Z")
Use SAML authentication, you can map groups to teams with the SAML Team Attribute Mapping. [https://docs.ansible.com/ansible-tower/latest/html/administration/ent\_auth.html#saml-authentication-settings](https://docs.ansible.com/ansible-tower/latest/html/administration/ent_auth.html#saml-authentication-settings) ---
**Author:** ![Karen\_Lopez](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/karen_lopez/32/7035_2.png) [@Karen\_Lopez](https://forum.ansible.com/u/Karen_Lopez)\ **Post date:** [February 5, 2025, 10:25pm UTC](https://forum.ansible.com/t/user-management-based-on-azure-ad-groups/2602/11 "2025-02-05T22:25:31Z")
Thanks for the link. I was able to get the value to put in for the redirect URI on th ENTRA side. ---
**Author:** ![MallocArray](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mallocarray/32/1655_2.png) [@MallocArray](https://forum.ansible.com/u/MallocArray)\ **Post date:** [March 6, 2025, 7:27pm UTC](https://forum.ansible.com/t/user-management-based-on-azure-ad-groups/2602/12 "2025-03-06T19:27:09Z")
I’m also running into the limitation of Azure AD not letting me map users to teams based on their AD groups or to make them super users, like we currently do with LDAP. Another team is looking at SAML, which is much more complex of a configuration, but hopefully it will still let us use the AD groups.