Add one more attribute for the user's groups:
- Under the attribute name, enter exactly:
http://schemas.microsoft.com/ws/2008/06/identity/claims/groups - Send one value for each group the user belongs to.
- Note whether your identity provider sends each group's name or an ID. You will need that value in the last step.
If your identity provider can filter the groups it sends, send only the groups Mediaflow's SSO setup page asks for. That keeps the sign-in small and fast.