I have a SP2013 farm with a User Profile Service populated with an External Identity Provider (MIM 2016 to be more specific). The Identity Manager takes users for several Active Directories and through the SPS-Claim properties (ADFS authentication will be used), it correctly provisions all users in the UPS setting the AccountName property as i:05.t|ClaimProviderID|userMail.
I have created an AD Group and assigned membership to all users synced in the UPS. Finally, I have assigned permission to my SharePoint Site Collection $url using the AD group.
The problem is that, if I run:
Get-SPUser -Web $url | select UserLogin
No user is visualized unless an .EnsureUser() is executed or a login is performed by the user.
To deeply investigate how SP is managing the users prior to the .EnsureUser(), I performed a .ResolvePrincipal(). The user is returned as PrincipalType.SecurityGroup (not good...) and the LoginName is the user E-mail and not the AccountName previously specified.
Since new users can be detected by the MIM any time, I would like the users to be directly linked to the site in order to be able to run the Get-SPUser without any additional operations. How to achieve this?