Hi We have a sharepoint 2013 instance and we are setting up claims based authentication with SAML assertions (ADFS 3.0 IDP). I am able to grant access to a user by adding the user's email address to the web application's user policy. This works fine however I am unable to grant access by group.

I created claim type mappings for email,UPN,Role, and SID.

$emailClaimMap = New-SPClaimTypeMapping -IncomingClaimType   "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "EmailAddress" -SameAsIncoming
$upnClaimMap = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" -IncomingClaimTypeDisplayName "UPN" -SameAsIncoming
$roleClaimMap = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" -IncomingClaimTypeDisplayName "Role" -SameAsIncoming
$sidClaimMap = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid" -IncomingClaimTypeDisplayName "SID" -SameAsIncoming

Here are the ADFS claim rules

ADFS Claim Rules

What is the correct way to grant access to a user based on group membership?

  • what error you are getting when type the group? are you typing group name or what?
    – Waqas Sarwar MVP
    Jun 4, 2015 at 19:25
  • No error, I just get permission denied when I try to access the site as a user that is a member of the test group. I am typing in the Netbios name of the group (picker doesn't work since it's using an IDP).
    – m3ta
    Jun 4, 2015 at 19:27
  • It looks like our settings match those in the link you referenced and I don't think the hotfix is applicable since we are on Sharepoint 2013.
    – m3ta
    Jun 4, 2015 at 20:56

1 Answer 1


I figured it out. The group I was using was configured as a Distribution group and not a Security group.

Also, when using the picker for adding a user/group to a sharepoint group I had to mouse over the search result and make sure I selected the entry with the Role claim.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.