If you send an email to meraki-anyconnect-beta@cisco.com with a link to your org dashboard and ask them to enable "SAML AnyConnect Group Policy", then they'll turn it on for you.
Once enabled you'll see this:
To answer @znet and @GIdenJoe , if you are using Entra ID you can map Entra groups to Meraki group policies. There are several ways of doing it. Basically you pass whatever Meraki group policy you want applied to the user in the SAML attribute (called "vpnfilter" in my example - but you can call it anything you like).
Basically you can say if you are a member of "this" list of groups, apply this policy ("VPN-Humans" in this example). You can keep adding more and more criteria and specifying different Meraki group policies to apply.
There is more than one way to do this. Start at https://entra.microsoft.com/, go into Applicatoins/Enterprise Applications/<select your AnyConnect app>/Single Sign On, and edit (2) Attributes & Claims.
Then click "Add new claim". For the name enter "vpnpolicy". Expand "Claim Conditions". Set "User Type" to "Members". For "Scoped Group" select an existing Entra ID group. For the "Source" put "Attribute".
The attribute field is a down down list - but that is just a guide. Instead just type in the Meraki group policy that you want to apply.
Add as many claim conditions as required to match Entra ID groups to Meraki group policies.
I prefix my group policies that are used for VPNs with VPN- but you can use whatever naming convention you want.
On the Meraki side, make sure you put the same claim name in the AnyConnect config, in this case, vpnpolicy.
It is much easier doing it with Duo. Define "Role Attributes" so it looks like this:
"VPN-Humans" is the Meraki group policy to apply.
I configure AnyConnect using as a "Generic SAML Service Provider" (this shows all the options).
This is what it looks like for me:
