Let us assume that you have an external identity provider configured...
You need to change these setting under the Identity Provider setting:
Make a group: