Having SharePoint OnPrem, ADFS, Azure AD Sync etc in place and wanting to use Azure AD B2B for external user access the authentication of external users in the SharePoint Web Application is now possible.

Creating an "Azure Security Group" (putting all external users in it) and authorizing this group in our SharePoint OnPrem SiteCollection does not authenticate users (Access denied).

So the resolvement of "Azure Security Groups" seem not to work. In the SAML token (which reaches SharePoint) the role claims are not existent although we configured the Token Issuer with the role claim rule (http://schemas.microsoft.com/ws/2008/06/identity/claims/role).

What are we missing? Is Azure AD B2B with "Azure Groups" possible? I found no article describing this in the web.

1 Answer 1


Now Azure AD Groups are transmitted as Roles-Claim to SharePoint. The only thing we changed was the AzureCP configuration (Claims Provider) by removing the UPN Claim, so that only EmailAddress and Role is used as Claim types mapped to Azure objects.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.