As of 7.0, Group Mapping is now available for SSO Realms. This guide will show you what to do in FlexDeploy to enable it. If you are using OIDC, you will also need to add a scope setting. See TODO about that.
...
The line
oidcConfig.scope = openid,groups,profile,email
needs to be added on the general tab if it isn’t there.
When you edit your SSO realm, you will find a tab for Group Mapping.
...