Group Membership ADFS Claim rule migration on Azure AD

Amrit Lal 20

We need to migrate below group membership ADFS claim rules on Entra ID (B2B). Please meRuleName = ""CheckGroupMembership""

c:[Type == ""http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"", Issuer == ""AD AUTHORITY""]

=> add(store = ""Active Directory"", types = (""http://schemas.xmlsoap.org/claims/Group""), query = "";memberOf;{0}"", param = c.Value);

RuleName = ""CheckCandorMembership""

c:[Type == ""http://schemas.xmlsoap.org/claims/Group"", Value =~ ""(?i)Candor""]

=> add(Type = ""CandorGroupsWithDN"", Value = c.Value);

RuleName = ""RemoveGroupDN""

c:[Type == ""CandorGroupsWithDN""]

=> add(Type = ""CandorGroupsWithoutDN"", Value = RegExReplace(c.Value, "",[^\n]*"", """"));

RuleName = ""RemoveGroupCN""

c:[Type == ""CandorGroupsWithoutDN""]

=> add(Type = ""http://abc.in/attributes/1/candorgroup"", Value = RegExReplace(c.Value, ""^CN="", """"));

@James Hamil

Janaki Kota 0 Reputation points Microsoft Vendor

2024-12-24T23:14:40.14+00:00

Hello @Amrit Lal,

Thank you for reaching out Microsoft Q&A.

I understand that you are trying to migrate group membership ADFS claim rules on Entra ID.

Usually, group and role claims emitted from Microsoft Entra ID might contain the domain-qualified sAMAccountName attribute or the GroupSID attribute synced from Active Directory, rather than the group's Microsoft Entra ID objectID attribute.

Applications can further call the Microsoft Graph group's endpoint to obtain group information for the authenticated user which ensures that all the groups where a user is a member are available, even when a large number of groups is involved.

However, if an existing application expects to consume group information via claims, you can configure Microsoft Entra ID with various claim formats.

These are the supported formats for group claims:

Microsoft Entra group ObjectId: Available for all groups.

sAMAccountName: Available for groups synchronized from Active Directory.

NetbiosDomain\sAMAccountName: Available for groups synchronized from Active Directory.

DNSDomainName\sAMAccountName: Available for groups synchronized from Active Directory.

On-premises group security identifier: Available for groups synchronized from Active Directory.

Please refer this below document for more details: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims

I hope this explanation helps to clarify the situation. If you have any further questions or need assistance with any other issues, feel free to reach out.

Best Regards,
Janaki Kota

Share via

Group Membership ADFS Claim rule migration on Azure AD

Your answer