Trying to switch from an ADFS Trusted Identity Provider to Kerberos. In the user profile service, users appear to be different identities. Do I need to migrate every account using Move-SPUser? It seems like most other migrations go from Kerberos to a trusted identity provider not the other way around

  • Are you going ntlm with kerberos from ADFS?
    – Waqas Sarwar MVP
    Nov 13, 2016 at 17:02
  • that is correct
    – MattC
    Nov 13, 2016 at 17:26
  • Then yes you have to run the move spuser, check my reply
    – Waqas Sarwar MVP
    Nov 13, 2016 at 17:38

3 Answers 3


In this case, yes you have to migrate all users from ADFS to windows claims. As sharepoint treat both as a separate ids.

You can also witness after switching the authentication, your user will get access denied. Now you have to run the move spuser to move them.

Read this


Convert-SPWebApplication -Identity "http://XXX:8001/" -To Claims -RetainPermissions

I use the above command to convert website XXX on port 8001 to Claims mode.

A good Microsoft reference is: https://blogs.msdn.microsoft.com/besidethepoint/2010/05/08/double-hop-authentication-why-ntlm-fails-and-kerberos-works/


Migrating from SAML to Windows Claims requires some slightly different steps. Microsoft has outlined it here: Migration of Windows claims authentication to SAML-based claims authentication in SharePoint Server 2013. Note that this article includes both processes (Windows -> SAML; SAML -> Windows).

You may also find this KB useful if you run into any issues with the conversion. The Convert-SPWebApplication command cannot convert from Windows claims to SAML in SharePoint Server 2013.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.