Filter groups by name prefix on Microsoft connector

[skeletonz28]

Hi all

We are slowly adding Microsoft as a connector to our Dex configs, moving away from SAML
This being what is is, SAML we could filter the groups on Azure application configuration
Now with Microsoft, we cannot do so on that, so we need to limit the groups returning to our clients

I have seen this ticket, and tried to do the same
#3385

But I cannot either get the filter correct, or am just getting the error that I (attempting to logon) am not a member of the group (yet I am)

The config we have:

- type: microsoft
      id: microsoft
      name: "Microsoft OAuth 2.0"
      config:
        clientID: "secret"
        clientSecret: "{{ .Env.AZURE_CLIENT_SECRET }}"
        tenant: "tenant"
        redirectURI: "https://dex-rnd.rnd/callback"
        scopes:
          - openid
          - profile
          - email
        userNameKey: preferred_username

        groupsKey: groups

        emailToLowercase: true

        # Now filter them
        # This uses regex — only include groups starting with G_ODIN
        groups: ["G_ODIN_*"]
         #- G_ODIN
        useGroupsAsWhitelist: true

I've tried searching for similar issues/topics, but everyone has a different flavour to their groups, and most times I see something like
developers
Are these groups you assigned to the Azure app?

So what am I doing wrong with the filter? Is it possible to start with?
Reason being, the tokens we get back are way to big currently, as they pull all the groups, email lists and everything from Azure. We also just want to limit to these groups as we have many clients and services using just these

[skeletonz28]

I think I have found the error of my ways
I realised after testing that this restricts those who can sign in, not reduce the token/header received from Microsoft
I am looking into other ways of reducing the token size, as as mentioned, it's returning all the groups