From d029ed26e3f8b67fe20fba19a68721fbdedf34fe Mon Sep 17 00:00:00 2001 From: Danny Lai Date: Tue, 7 Jul 2026 14:38:53 +0000 Subject: [PATCH] Enhance Microsoft connector documentation with group lookup batching and configuration details xref https://github.com/dexidp/dex/pull/4833 Signed-off-by: Danny Lai --- content/docs/connectors/microsoft.md | 35 +++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-) diff --git a/content/docs/connectors/microsoft.md b/content/docs/connectors/microsoft.md index f1472cf..ab241eb 100644 --- a/content/docs/connectors/microsoft.md +++ b/content/docs/connectors/microsoft.md @@ -208,4 +208,37 @@ connectors: # All relevant E-Mail Addresses delivered by AD will transformed to # lowercase if config is TRUE emailToLowercase: true -``` \ No newline at end of file +``` + +By default, dex resolves group ids to group names with a single request to +the Microsoft Graph API. Microsoft Graph's +[`directoryObjects/getByIds`](https://learn.microsoft.com/en-us/graph/api/directoryobject-getbyids) +endpoint caps that request at 1000 ids, so a user who is a member of more +than 1000 groups will fail to log in. + +Setting the `batchGroupLookups` (boolean) configuration option splits the +lookup into batches of 1000 group ids, supporting users with larger group +memberships. This is opt-in because it trades that login failure for +additional requests to the Microsoft Graph API — one extra request per 1000 +groups a user belongs to — which may not be desirable for every deployment. + +```yaml +connectors: + - type: microsoft + # Required field for connector id. + id: microsoft + # Required field for connector name. + name: Microsoft + config: + # Credentials can be string literals or pulled from the environment. + clientID: $MICROSOFT_APPLICATION_ID + clientSecret: $MICROSOFT_CLIENT_SECRET + redirectURI: http://127.0.0.1:5556/dex/callback + tenant: myorg.onmicrosoft.com + groups: + - developers + - devops + # Split group name lookups into batches of 1000 ids, supporting users + # in more than 1000 groups. + batchGroupLookups: true +```