Just wanted to say a big thank you to you mate. I changed “profile” to “groups” and the SSO groups matching started working after i cleared cache + went into incognito mode. It seems the groups matching happens only on login/authentication which is why i might’ve been having issues testing different config changes.
Again, thank you so much!