Using version 9.0R1.01, I found I'm able to use a backslash to escape the dots in the namespace. I also found that samlMultiVarAttr is not present if there is only one element in the list, so you have to account for both cases: Match if there is exactly one role, and it's named "Role1": userAttr.{http://schemas\.microsoft\.com/ws/2008/06/identity/claims/role} = 'Role1' Match if there are multiple roles, and at least one of them is "Role1": samlMultiValAttr.{http://schemas\.microsoft\.com/ws/2008/06/identity/claims/role} = 'Role1' My resulting expression to match if any of the roles is "Role1": userAttr.{http://schemas\.microsoft\.com/ws/2008/06/identity/claims/role} = 'Role1' OR samlMultiValAttr.{http://schemas\.microsoft\.com/ws/2008/06/identity/claims/role} = 'Role1'   ... View more