Azure AD SAML group claims return only on-prem AD groups when user is member of both cloud and on-prem groups

azure-active-directory single-sign-on saml microsoft-entra-id