The part that surprised me most was finding the SAML XML sitting in G_X01. That's the kind of undocumented behavior you only find by poking around in a playground, and it's what makes this post useful — the official docs wouldn't have told you that. Using group IDs instead of group names is the right call, too. A rename shouldn't silently change who gets admin access. And getting this done without a separate Graph call keeps the login flow simple, which matters more than it looks. Thanks for writing up the full chain, Entra claim to session state, instead of just the extraction query.