question

TurpinJames-7320 avatar image
0 Votes"
TurpinJames-7320 asked sikumars commented

Moving from ADFS > ADFS to AzureAD > AzureAD for claim provider trust

We have ADFS on-prem with a relying party trust to our on-prem web app (in our company A).
We grant access to the on-prem app to company B, by adding a claims provider trust to company B (they use ADFS) and passing / transforming claims into the RP - works great.

We wish to use our AzureAD now to do this (company A) and Company B also have Azure AD they wish to use.

My question is, how do we create a claims provider trust in Company A AAD to Company B AAD to achieve the same / test this out?

We tried to add company B's AAD SAML info using external identity providers > new SAML IDP but it errorr'd saying company B is running AAD....
Is there another way we need to do the claim provider trust we are missing?

azure-ad-saml-ssoadfs-to-aad-migration
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @TurpinJames-7320, Just checking to see if the answer was helpful to you. If so, please remember to "mark as answer" so that others in the community can more easily find a resolution. Otherwise, if you're still facing this problem, please let us know so we can help troubleshoot!

0 Votes 0 ·

Hello@TurpinJames-7320,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Thanks,

0 Votes 0 ·

1 Answer

sikumars avatar image
0 Votes"
sikumars answered sikumars edited

Hello @TurpinJames-7320 ,

Thanks for reaching out and sorry for delayed response.

You don't have to create claims provider trust, because when your partner organization own an Azure Active Directory account or a Microsoft Account then you could leverage either of way to achieve your scenario.

In order to allow user from Tenant-B to access Tenant-A's application both methods can be used.

Business-to-business (B2B) collaboration:

Azure Active Directory (Azure AD) business-to-business (B2B) collaboration is a feature within External Identities that lets you invite guest users to collaborate with your organization. With B2B collaboration, you can securely share your company's applications

Example: If you create a single tenant app, you need to invite users of Company-B to Tenant-A. In this case, Administrator of Tenant-A can take the authorization decisions by selecting which users should and shouldn't be assigned to the application.

To learn more about B2B collaboration: https://docs.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b

Multi-Tenant App concept:

If you're providing an app as a service and you don't want to manage your customers' user accounts, a multitenant app is likely the right choice for you. When you develop applications intended for other Azure AD tenants, you can target users from a single organization (single tenant), or users from any organization that already has an Azure AD tenant (multitenant applications).

Example: If you create a Multi-Tenant App in Company-A and any user from Company-B tries to access that application, user will be prompted with a consent prompt. Once the consent is provided, a service principal corresponding to the app in Tenant-A will be created in Tenant-B. User of Tenant-B will be able to access the application. You can search the service principal under Tenant-B's enterprise applications blade by using the App ID. In this case, Administrator of Tenant-B needs to take authorization decisions by going to the properties of the service principal and set User assignment required to Yes and then assigned required set of users.

To learn more about Multi-Tenant App: https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/

You can decide based on what fits the best in your scenario. Hope I have covered all the aspects of your question.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.