I have set up our default SP web app and my sites in our QA environment to use ADFS. I have also created a custom claims provider to resolve the ADFS names in the people picker. I have two outstanding issues, however.

The first issue is the ADFS names are not resolving in central admin, which is using NTLM. I need this web app to resolve both NTLM and ADFS names

enter image description here

The second is there are two names showing in the people picker in our SP web app; one from NTLM and the other from ADFS. I would like to remove the NTLM version without having to turn NTLM off on the web app.

EDIT: I found how to hide the AD users in the people picker:

Hide Default Authentication provider

You just run the following PowerShell cmd:

# hide the AD users in the people picker
$cpm = Get-SPClaimProviderManager
$ad = get-spclaimprovider -identity "AD"
$ad.IsVisible = $false

Edit 2

Unfortunately, the above command hides the AD provider across the farm. That means central admin too. Likewise, we have two other web apps that are still going to use NTLM, so I can't hide the AD provider unless there is a way to do it per web app, which I haven't found..

1 Answer 1


If you use NTLM on a Web Application that is associated with a UPA Proxy, users will create a new User Profile when visiting a site on that NTLM Web App. There is no good way to prevent this, other than converting all Web Applications to use SAML. You can either disassociate the NTLM Web Apps with the UPA Proxy, or create a script that runs on a periodic basis to remove any User Profiles that start with DOMAIN\.

As far as your Manager in the profile, verify the manager exists in the UPA with a SAML profile as well.

  • I didn't find a solution this this issue but I decided to go with a codeplex ADFS custom claims provider solution instead of my own and it turns out the names are resolving now in central admin. It must have been something with the claims provider I developed. Commented Jan 16, 2016 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.