Send your groups in the ID token

1. Add a claim named exactly groups to the ID token, or to the userinfo response.
2. Let it hold a list with one value for each group the user belongs to.
3. Note whether your identity provider sends each group's name or an ID. You will need that value in the last step.

If your identity provider can filter the groups it sends, send only the groups Mediaflow's SSO setup page asks for.