hey folks does loadTenantGroups should return groups from idp? I have a google workspace integration configured with JIt and groups are mapped (I see the claim when testing and user also gets the right role), but when calling this api with the tenant id I get data = []

External Groups vs SCIM Groups The

loadTenantGroups

API returns external groups that are provisioned through SCIM, not JIT-provisioned groups from OIDC/SAML claims . Why You're Seeing Empty Results With Google Workspace using JIT provisioning only, group information exists in OIDC claims but isn't provisioned as external groups in Descope. The API only returns groups that have been synchronized through SCIM provisioning . Solutions 1. Enable SCIM provisioning in Google Workspace to sync groups 2. Use group claims from the user's JWT token instead:

// Access group information from user session
const user = descope.getUser();
const groups = user.customClaims?.groups || [];

• Groups from JIT are available in the user's token claims, not the external groups API •

loadTenantGroups

requires SCIM provisioning to return data Load All External Groups for Specific Members | API Reference | Descope Documentation Group Management API | Descope Documentation

External groups (loadTenantGroups) is only populated if they're provisioned via SCIM. The group mapping would be in the response of getting the tenant sso settings https://docs.descope.com/api/management/tenants/sso/load-sso-settings

You can also use the idpGroups to get the groups from the IdP (upon login)