How to configure RBAC for Office365?

[alessandroderoma]

I'm using Argocd 2.5.2 in an AKS cluster.

I set up SAML authentication as described here and it's working, I can now give Office365 users access to the application without using the admin user.

My issue is that even if I provided the RBAC configuration as described in the "Configure Argo to use the new Azure AD enterprise app" section it seems it's being ignored.

I created two groups, "Cluster Viewers" (id 4984e4f5-0000-0000-0000-000000000000) and "Cluster Administrators" (id f6098101-0000-0000-0000-000000000000), then I defined my own policy based on the one above, giving just administrators the rights to operate on the cluster, leaving other groups in readonly mode by default policy:

  policy.default: role:readonly
  policy.csv: |
    p, role:org-admin, applications, *, */*, allow
    p, role:org-admin, clusters, get, *, allow
    p, role:org-admin, repositories, get, *, allow
    p, role:org-admin, repositories, create, *, allow
    p, role:org-admin, repositories, update, *, allow
    p, role:org-admin, repositories, delete, *, allow
    g, "f6098101-0000-0000-0000-000000000000", role:org-admin

I then added my user to the "cluster viewers" group leaving the "cluster administrators" group empty; in my understanding "cluster viewers" should get the role:readonly as per default policy but I logged into ArgoCD via SAML and I can do whatever I want on the cluster (create/delete apps, sync, refresh, etc).

If I go to ArgoCD's "User Info" page I see:

Username: ##############

Issuer: #############

Groups:

77019547-0000-0000-0000-000000000000
4984e4f5-0000-0000-0000-000000000000
1cd31a4a-0000-0000-0000-000000000000
46124e87-0000-0000-0000-000000000000
a06d5e15-0000-0000-0000-000000000000
eb0a0304-0000-0000-0000-000000000000
ad2497a3-0000-0000-0000-000000000000
47c29faf-0000-0000-0000-000000000000
3028dd0d-0000-0000-0000-000000000000
451b9db0-0000-0000-0000-000000000000
50547475-0000-0000-0000-000000000000

As you can see, in my groups there is no f6098101-0000-0000-0000-000000000000, which should be the only group to get full read/write rights, so I feel I should really only be able to see applications without editing/syncing/other operations.

Am I missing something here?