By cooleb09
So SSO is supported for DO Teams, which is nice for us as we are looking to move some existing applications into the platform, however the IDP instructions shown in the docs doesn’t include Entra ID (Major IDP used by MS365/Azure).
Tried to configure it anyway - as OIDC is an open standard so figured it was worth a try- however it seems to not work ‘out of the box’.
Checking the logs in dev tools shows:
https://cloud.digitalocean.com/sessions/sso/callback?error=invalid_client&error_description=AADSTS650053%3a+The+application+%27Digital+Ocean%27+asked+for+scope+%27groups%27+that+doesn%27t+exist+on+the+resource+%2700000003-0000-0000-c000-000000000000%27.+Contact+the+app+vendor
The ‘missing’ ‘groups’ scope aligns with the Microsoft docs, and what we see in our tenant when configure app API permissions (OpenID Permissions includes only email, offline_access, openid & profile).
Looking at the OpenID spec,the groups claim being requested is not a standard claim per the spec, which would explain why it is not present in Entra. Entra (correctly) doesn’t list ‘groups’ in the ‘scopes_supported’ section of the discover endpoint (provider URL) configured in the Digital Ocean SSO settings.
Has anyone else run into this with Entra or other IDPs with DO Teams and have a work around?
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
I believe DigitalOcean’s OIDC implementation expects openid, email, profile, team_role, and groups as scopes, and it’s requesting groups as a literal OAuth scope, which Entra ID doesn’t support because Entra treats group membership as a claim, not a scope. You’re not the first to hit this specific mismatch, other OIDC clients that hardcode a groups scope request run into the same wall against Entra ID for the same reason.
Worth testing with a user in a small number of groups first, Entra ID’s group overage behavior kicks in above a certain group count and swaps the claim for a reference to the Graph API instead of the actual group list, which DigitalOcean’s OIDC handling likely won’t follow through on. Setting the groups claim to “groups assigned to the application” rather than all groups avoids that if it’s a risk for your tenant.
Hope that this helps!
Hi there,
Good analysis and alexdo is right on the root cause. DigitalOcean’s SSO implementation is hardcoding a groups scope in the OIDC request, which is not a standard scope and Entra ID correctly rejects it.
There is no clean workaround on the client side since you cannot control what scopes DigitalOcean requests. The realistic options are:
If you have an Okta or Google Workspace tenant available, those are the IDPs that work out of the box with DigitalOcean SSO since they support the groups scope as expected.
If Entra ID is a hard requirement, this is worth raising as a support ticket and a feature request at https://ideas.digitalocean.com. The fix needs to happen on DigitalOcean’s side, either by making the groups scope optional or by supporting Entra’s approach of groups as claims rather than scopes. The more teams request this, the more likely it gets prioritized given how common Entra ID is in enterprise environments.
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and AI-native businesses
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Start building today
From GPU-powered inference and Kubernetes to managed databases and storage, get everything you need to build, scale, and deploy intelligent applications.
