title: Get groups of user during provisioning on Enterprise application in Azure AD
body: <p>I am writing Azure AD provisioning support for our SAAS. I am using the SCIM standard to get user and group data from Azure AD.</p>
  <p>However I am only getting groups that is actively added to the application (as it is set up to only sync users added to the enterprise application).</p>
  <p>Example, we have three users</p>
  <ul>
  <li>User One, part of groups <strong>IT</strong> and <strong>Rome</strong></li>
  <li>User Two, part of groups <strong>IT</strong> and <strong>Berlin</strong></li>
  <li>User Three, part of groups <strong>HR</strong> and <strong>Stockholm</strong></li>
  </ul>
  <p>I now add the following to my Enterprise application</p>
  <pre><code>Group IT, User Two, User Three
  </code></pre>
  <p>Now the data I will get sent to my application from Azure AD (via SCIM) is:</p>
  <ul>
  <li>Create User One</li>
  <li>Create User Two //Would have been created from adding group IT anyway</li>
  <li>Create User Three</li>
  <li>Create group IT</li>
  <li>Add users One, Two to group IT</li>
  </ul>
  <p>This is a very incomplete picture as I would like to have the missing groups (HR, Rome, Berlin, Stockholm) so that I can tag up the users in our SAAS so they can use these groups/tags to create rules.</p>
  <p>Is there any way to get groups that a user on the application have, even if the group itself was not added to the application?</p>
  <p>A good example is, I want to know users' cities as it's a good differentiator to create rules on. But I do not want to add a city-group to our application as I do not want all users for a city to have access. However I do want to know the city for the users that  do have access!</p>