Azure Could not get Azure AD group name(s), please… – Qlik Community

I am doing an IDP switch where in i am pointing the Identity provider from a cloud based azure AD to on-prem azure AD. I am getting the following error. This error is showing up only for external users on the AD and not internal users. 

I used the diagnose endpoint to check the claims returned by the IDp. 

The issue seems to be with authorization – missing the group claim in the auth response returned by the AD but only for the migrated internal users and all external users.

Following is the error. Please let me know how to resolve this. 

{
  “errors”: [
    {
      “title”: “Authentication failed”,
      “detail”: “could not get Azure AD group name(s), please ensure your Azure AD app has sufficient Group API permissions with admin consent (minimum ‘GroupMember.Read.All’)”,
      “code”: “LOGIN-1”,
      “status”: “401”
    }
  ],
  “traceId”: “047b9c22f471aa350106f5ebb2d2c8db”
}