# Vault Azure-OIDC setup issue

**URL:** <https://discuss.hashicorp.com/t/vault-azure-oidc-setup-issue/75683>\
**Category:** Vault\
**Created:** [July 2, 2025, 10:37am UTC](https://discuss.hashicorp.com/t/vault-azure-oidc-setup-issue/75683 "2025-07-02T10:37:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bharat-vyas](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/bharat-vyas/32/45709_2.png) [@Bharat-vyas](https://discuss.hashicorp.com/u/Bharat-vyas)\
**Post date:** [July 2, 2025, 10:37am UTC](https://discuss.hashicorp.com/t/vault-azure-oidc-setup-issue/75683/1 "2025-07-02T10:37:24Z")

</div>

I am using vault with Azure-AD-OIDC (login with email)

I am using below commands -

```auto
vault auth enable oidc

vault write auth/oidc/config \
   oidc_client_id="6da27bcb-c9cb-424e-a959- *****" \
   oidc_client_secret="Jh68Q~L7.tpaZfCT0WiTCIFNzV9Q *********" \
   default_role="azure-ad-role" \
   oidc_discovery_url="https://login.microsoftonline.com/e3e735ae-c338-4e2a-8634- ******** /v2.0"

vault write auth/oidc/role/azure-ad-role \
   user_claim="sub" \
   allowed_redirect_uris="https://vault.cci.com/ui/vault/auth/oidc/oidc/callback" \
   groups_claim="groups" \
   oidc_scopes="https://graph.microsoft.com/.default profile" \
   policies=default

vault write identity/group-alias \
   name="ecae7026-d666-450a-9dc7-8e3 *******" \
   mount_accessor="auth_oidc_7747eec8" \
   canonical_id="0e3ee6f7-fe99-30b7-84bf-60 *******"

```

Here in last command “ecae7026-d666-450a-9dc7-8e3\*\*\*\*\*\*\*”" this is my Object-group-ID  
And 0e3ee6f7-fe99-30b7-84bf-60\*\*\*\*\*\*\* is the vault-group-ID

Everything is working fine and I am able to login into vault with OIDC (email)  
As I am member of ecae7026-d666-450a-9dc7-8e3\*\*\*\*\*\*\* group

Same as me one more person is member of ecae7026-d666-450a-9dc7-8e3\*\*\*\*\*\*\* group  
But he is not able to login and getting error -

```auto
failed to fetch groups: "groups" claim not found in token

```

While checking I noticed that I am member of 90 groups but he is member of 300 groups

Is there any other parameter or configuration that we have to provide in above commands ?

---

<div class="post-metadata">

**Author:** ![jonathanfrappier](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jonathanfrappier/32/28004_2.png) [@jonathanfrappier](https://discuss.hashicorp.com/u/jonathanfrappier)\
**Post date:** [July 3, 2025, 6:49pm UTC](https://discuss.hashicorp.com/t/vault-azure-oidc-setup-issue/75683/2 "2025-07-03T18:49:15Z")

</div>

Have you reviewed this in the OIDC/JWT docs?

> If a user is a member of more than 200 groups (directly or indirectly)…

> **[Use Azure AD for OIDC | Vault | HashiCorp Developer](https://developer.hashicorp.com/vault/docs/auth/jwt/oidc-providers/azuread#optional-azure-specific-configuration)**
>
> Configure Vault to use Azure Active Directory (AD) as an OIDC provider.

---

<div class="post-metadata">

**Author:** ![Bharat-vyas](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/bharat-vyas/32/45709_2.png) [@Bharat-vyas](https://discuss.hashicorp.com/u/Bharat-vyas)\
**Post date:** [July 4, 2025, 5:13am UTC](https://discuss.hashicorp.com/t/vault-azure-oidc-setup-issue/75683/3 "2025-07-04T05:13:24Z")

</div>

HI @jonathanfrappier

It worked ! Changed some Azure configuration as well as vault commands  
Thanks