When I try to add an ADFS user to the 'Administrators for User Profile Service' list through Central Administration I get the error 'Specified argument was out of the range of valid values. Parameter name: claim'.

UPS Admin

Trying to add via PowerShell via the following command gives the same error:

$serviceapp = Get-SPServiceApplication myApplicationId
$security = Get-SPServiceApplicationSecurity $serviceapp -Admin
$principalUser = New-SPClaimsPrincipal -Identity "i:0e.t|adfs|[email protected]" -IdentityType EncodedClaim
Grant-SPObjectSecurity $security -Principal $principalUser -Rights "Full Control"
Set-SPServiceApplicationSecurity $serviceapp -ObjectSecurity $security -Admin

ULS logs the following error as well: The claim 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn: [email protected]' could not be added to the delegated administrators group because it does not represent a user or security group.

Also, when I try to give an ADFS user Connection Permissions to the User Profile Service through Central Administration, I get the error, "The User Profile Service Requires domain credentials for connection access":

Connection Permissions

How do you add ADFS users as User Profile Service Administrators?

  • Is your sharepoint configured to use users from ADFS?
    – martusha
    May 23, 2016 at 13:28
  • On this link sharepointobservations.wordpress.com/2013/08/19/… on the second part about "Configure SharePoint Web Application" is guide how to configure everything correctly. Hope this helps.
    – martusha
    May 23, 2016 at 13:32
  • SharePoint is configured to use ADFS. My question is solely how to add ADFS users as User Profile Service Administrators. May 23, 2016 at 14:17

1 Answer 1


Only Windows (Domain) users can be added to Service Application security.

  • Given the scenario of an ADFS only deployment (other than Central Admin), how could an admin delete a Newsfeed post? May 23, 2016 at 14:33
  • Well, given you need to have a Windows Claims enabled zone, in that case they would need to use that zone instead of their ADFS credentials.
    – user6024
    May 23, 2016 at 14:45
  • By ADFS only, I meant that there is no available Windows Claim Zone. May 23, 2016 at 15:34
  • Then Search won't function, which is typically important.
    – user6024
    May 23, 2016 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.