The AD FS Help Portal is set to be deprecated soon. All the contents related to AD FS will be moved to Microsoft Learn AD FS troubleshooting documentation will keep existing within Troubleshoot AD FS

AD FS Help Azure AD RPT Claim Rules

Azure AD RPT Claim Rules

Designed for a single domain or multiple domains. Walk through our simple process to get the right claims for your federation trust between Azure AD and AD FS

In order for AD FS to work with Azure AD, your AD FS relying party trust needs to contain the set of claims that is tailored to your organization. If any of the information is wrong, it will affect user login. We know this can be difficult to create yourself, so we’ll help guide you through the process. Just make sure that the Azure AD relying party trust is already in place.

We recommend using Azure AD Connect to manage your Azure AD trust. It will automatically update the claim rules for you based on your tenant information. However, if you are not using it to manage your trust, proceed below to generate the same set of claims as AAD Connect. Learn more about Azure AD Connect with federation

If you only have one federated Azure AD domain (for example contoso.com) but plan on federating one or more additional domains (child1.contoso.com, child2.contoso.com or more), it is crucial that you update your claim rules prior to changing the Azure AD domain itself. If the claim rules are not updated prior to making the domain change, all users will be unable to sign-in.

In order to generate the right set of claims for your organization, we will need to ask you a few questions about your AAD Connect configuration.

Select how users should be uniquely identified with Azure AD. The Immutable ID attribute is defined as an attribute that is immutable during the lifetime of an object. It uniquely identifies an object as being the same object on-premises and in Azure AD, and is the primary key linking on-premises users with users in Azure AD. Learn more about Immutable ID attributes

Immutable ID

ObjectGUID ms-Ds-consistencyGuid with fallback to ObjectGUID Other

Select the attribute that users will use to sign into Azure AD. This will be what users type in for their username during login.

By default, Azure AD Connect uses the userPrincipalName attribute. However, the administrator may have selected an Alternate ID such as email. Enter in the configuration used with AAD Connect.

User Sign In

userPrincipalName Alternate ID

Does the Azure AD trust with AD FS support multiple domains?

Select Yes if you have multiple federated domains or the Azure AD trust was created using the -SupportMultipleDomain switch.

Yes No

Issuer Id Claim RegEx

For federating multiple domain, this is the regex that can be used to set correct IssuerId claim. The regex was developed using the domain information you provided.

Issuer Id RegEx

In order to update the claims on your Azure AD trust, click the copy button and run the PowerShell script on the primary AD FS server to set the correct claims. The script will also make a backup of the current claim rules for safe keeping.

PowerShell

Below are the individual claim rules required for your organization.

Claim Rules

In order to create the right set of claims, we need more information about your Azure AD domains. You can upload the information in a CSV file (recommended), or provide the information yourself.

Do you want to upload a CSV file?

Yes No

To get the domain information directly from your Azure AD tenant, perform the following steps:

Ensure that you have installed Azure Active Directory PowerShell modules. Download the Azure Active Directory PowerShell modules
Launch a PowerShell session.
Copy and run the following code snippet. This will generate the CSV file based on your tenant information.

PowerShell

Import-Module MSOnline; Connect-MsolService Get-MsolDomain | Select-Object Name, RootDomain, Authentication | ConvertTo-Csv -NoTypeInformation | % {$_.Replace('"','')} | Out-File output.csv
Sign in to Azure AD when prompted.
Upload the output.csv file.
If you are changing any domain from managed to federated, you will need to indicate the change below.

Manually enter in any Azure AD information below. Create an entry or modify an existing entry for each of the domains within your organization. To add new rows, click on the plus sign. For each entry provide the domain name, the root domain name, and the authentication type (Federated | Managed). If an entry is the root domain, then leave the Root Domain Name field empty.

Azure AD Domain Information
Domain Name	Root Domain Name	Authentication Type