Microsoft Entra ID users are loosing manually added groups after 1-3 days

[cybersolutions-daichinger]

Issue description

CMS Version: 13.10.1

We have recently added Microsoft Entra ID as a External Login Provider. We are required to set a "Default user group". Unfortunately we are experiencing some issues. After a sucessfull login, the user gets the default user group. The we add several other groups to an user manually in the CMS. After some time (1-3 days), the user is losing the manually added groups and only has the "Default user group".

We already talked to the support team twice, but unfortunalely they couldn't fix our problem.

[cybersolutions-mreiter]

Just jumping in here for my colleague and will try to give you some more information on our case:

Summary

We enabled EntraId Login for our Umbraco Cloud instance via the "External Login Providers" feature, following the documentation official documentation here

After this we now had 2 different cases:

1. We can login after this, the mapping from EntraId user group to Umbraco user group is also working as expected.
   The Problem now occurs a day or more later as the user group will now be set to "Editor".
   It doesn't matter what User Group the User had before (Admin, Translator, Custom ones), he will always end up as an "Editor".
   This case seems to be "fixed" for a couple of days, as now we are now encountering case 2.

2. After each login we loose our current user group and get assigned the "Editor" group, no matter the configuration and previous user groups

Our Configuration

As mentioned above we essentially just set up everything according to the documentation.
For scopes we have defined the following three:

• openid
• profile
• email

Auth Type is "OpenIdConnect"

User mapping options look like this:

Expected result

User Groups do not get set to "Editor" after logging in via EntraId.

Further Informations

I checked the audit logs in the database and found out that the change of the user group to the "Editor" group happens after a successful login.
It seems that it checks and changes the user group after each login, despite "Enforce user group on login" not beeing activated.

Something else I noticed is that it doesn't seem to be possible to remove every "User Group Mapping", as you can see in the picture above we are stuck with a mapping which is empty on the left side.
Maybe this can cause some problem when trying to find the correct user group to assign, falling back to the default group "Editor"?

[mikkelhm]

Hi to both of you - thanks for reaching out.

This does indeed seem strange - we will be investigating what could be happening. We have seen something similar previously, but have been unable to find a way to reproduce the behaviour - Your desscription in this issue will definetley help us debug further. We might reach out to get some more insights though.

Kind regards - Mikkel