Claim Descriptions The SAML 1.1 logon token issued by the AD FS 2.0 federation services to the Office 365 Identity Platform relying party contains claims sourced from the on-premise Active Directory claims provider (see next section) that allows the Office 365 sign-in service to match the user to a shadow identity in the cloud: The User Principle Name (UPN) of the corporate user, which is tied to the provisioned value for the user thanks to the directory synchronization. A unique, rename-safe identifier for the user, which must remain constant for the lifetime of the object in the cloud. This otherwise could lead to duplicate objects and unexpected synchronization errors. This is by default is the on-premise Active Directory Object GUID (ImmutableID). The Object GUID ByteArray is converted into Base64 string. Consequently, and for that specific purpose, you can see the following 2 claim descriptions: UPN (). Source user ID (). On-premise Active Directory Claims Provider Trust The following rules are declared for the Acceptance Transform Rules set regarding the Active Directory attribute store. The incoming claim types are as follows: Windows account name; Name; Primary SID; Group SID; Primary Group SID; Deny only group SID; Deny only primary SID; Deny only group SID; Authentication method; Authentication time stamp. Microsoft Office 365 Identity Platform Relying Party Trust The creation of the domain as a Federated domain with the Microsoft Online Services Module cmdlets (see section § 4.3.3 Creating a new domain as a federated domain) results in the automated definition of a new Microsoft Office 365 Identity Platform relying trust. Properties The Monitoring tab of the Microsoft Office 365 Identity Platform properties shows the URL from where the Office 365 sign-in service metadata are retrieved: .
Claim Descriptions The SAML 1.1 logon token issued by the AD FS 2.0 federation services to the Office 365 Identity Platform relying party contains claims sourced from the on-premise Active Directory claims provider (see next section) that allows the Office 365 sign-in service to match the user to a shadow identity in the cloud: The User Principle Name (UPN) of the corporate user, which is tied to the provisioned value for the user thanks to the directory synchronization. A unique, rename-safe identifier for the user, which must remain constant for the lifetime of the object in the cloud. This otherwise could lead to duplicate objects and unexpected synchronization errors. This is by default is the on-premise Active Directory Object GUID (ImmutableID). The Object GUID ByteArray is converted into Base64 string. Consequently, and for that specific purpose, you can see the following 2 claim descriptions: UPN (). Source user ID (). On-premise Active Directory Claims Provider Trust The following rules are declared for the Acceptance Transform Rules set regarding the Active Directory attribute store. The incoming claim types are as follows: Windows account name; Name; Primary SID; Group SID; Primary Group SID; Deny only group SID; Deny only primary SID; Deny only group SID; Authentication method; Authentication time stamp. Microsoft Office 365 Identity Platform Relying Party Trust The creation of the domain as a Federated domain with the Microsoft Online Services Module cmdlets (see section § 4.3.3 Creating a new domain as a federated domain) results in the automated definition of a new Microsoft Office 365 Identity Platform relying trust. Properties The Monitoring tab of the Microsoft Office 365 Identity Platform properties shows the URL from where the Office 365 sign-in service metadata are retrieved: .
Office365-Single%20Sign-On-with-AD-FS2.0-v1.0a.docx