This page the last section for Configure SAML with Azure AD to access Kibana that discusses "Role Mapping" has an example that leverages an outdate API. Instead of POST /_xpack/security/role_mapping/SAML_kibana, the API should be POST /_security/role_mapping/SAML_kibana
This example could be made more complete by showing how to create a role against an Active Directory group rather than <firstname.lastname> which I don't believe is a default returned from Azure AD into our Name field. By default, I believe its the user's principal, which based upon the example configurations above would be the users email address.
