📌 What is this guide answering?
“How do I update Microsoft Entra ID so Indeavor SSO continues working after the new security update?”
This guide explains exactly what to change in your Microsoft Entra ID setup to prevent login failures caused by oversized authentication requests.
🔍 Why this change is required
Indeavor is implementing a Web Application Firewall (WAF) that enforces strict limits on login request size.
Problem
Entra ID often sends too many group memberships and claims
Users with many groups (especially admins) may exceed size limits
Result:
❌ Login failures
❌ “Request too large” or header-size errors
Solution
✅ Only send groups assigned to the Indeavor application (not all directory groups)
This does not change certificates or SSO metadata
🧠 Key rule (applies to ALL setups)
✅ Use: Groups assigned to the application
❌ Avoid: All groups
✅ Keep only required claims
🛠️ Path A — OIDC (App Registrations)
Step 1: Open your Indeavor app
Go to: Entra ID > App registrations
Select your Indeavor app
Step 2: Open Token configuration
Navigate to: Manage > Token configuration
Click Add groups claim
Step 3: Reduce group output
In Edit groups claim:
❌ Do NOT select All groups
✅ Select Groups assigned to the application
✅ Save
Step 4: (Optional fallback) Edit manifest
If your process uses the manifest:
"groupMembershipClaims": "ApplicationGroup"
🛠️ Path B — SAML (Enterprise Applications)
Step 1: Open SSO settings
Go to: Entra ID > Enterprise applications
Select Indeavor app
Click Single sign-on
Under Attributes & Claims → Edit
Step 2: Add or edit group claim
Click Add a group claim
Choose Groups assigned to the application
Save
⚠️ Settings to avoid (common mistakes)
❌ Selecting All groups
❌ Adding unnecessary optional claims
❌ Using extra claim formatting unless needed
✅ Validate your change
After updating, test with a heavy-access user:
✅ Login completes successfully
✅ No request-size errors
✅ End-to-end SSO works
🧪 Testing recommendation
Use your sandbox environment first (available early July)
Apply changes there before production
🧩 Gaps or risks to highlight
These areas may need clarification for your team:
❓ Does your org use OIDC or SAML? (critical first step)
❓ Which claims does your Indeavor tenant actually require?
⚠️ No rollback steps are documented
⚠️ No troubleshooting section for failed logins
🚀 Quick summary checklist
Identify: OIDC or SAML
Update group claim scope
Remove “All groups”
Test with large-profile user
Validate in sandbox