Within the SAML Response message, the Signature node contains information about the digital signature for the message itself. Using the sample SAML request and response messages along with automated and manual testing, you can work to achieve interoperability with Azure AD. This section details how the request and response message pairs are put together in order to help you to format your messages correctly.Īzure AD can be configured to work with identity providers that use the SAML 2.0 SP Lite profile with some specific requirements as listed below. įor customers in China using the China-specific instance of Microsoft 365, the following federation endpoint should be used. The Azure AD metadata can be downloaded from this URL.

Once you are happy with your output messages, you can test with the Microsoft Connectivity Analyzer as described below. Also, use specific attribute values from the supplied Azure AD metadata where possible. It is recommended that you ensure your SAML 2.0 identity provider output messages be as similar to the provided sample traces as possible. The SAML 2.0 relying party (SP-STS) for a Microsoft cloud service used in this scenario is Azure AD. This document contains detailed requirements on the protocol and message formatting that your SAML 2.0 identity provider must implement to federate with Azure AD to enable sign-on to one or more Microsoft cloud services (such as Microsoft 365). For example, the Lync 2010 desktop client is not able to sign in to the service with your SAML 2.0 Identity Provider configured for single sign-on. Windows 8 Mail Client and Windows 8.1 Mail ClientĪll other clients are not available in this sign-on scenario with your SAML 2.0 Identity Provider.Windows Phone 7, Windows Phone 7.8, and Windows Phone 8.0.Microsoft Outlook 2010/Outlook 2013/Outlook 2016, Apple iPhone (various iOS versions).(the Enhanced Client Protocol end point is required to be deployed), including:

Email-rich clients that use basic authentication and a supported Exchange access method such as IMAP, POP, Active Sync, MAPI, etc.

Web-based clients such as Outlook Web Access and SharePoint Online.

Only a limited set of clients are available in this sign-on scenario with SAML 2.0 identity providers, this includes:

Download bionic domain