As mentioned in one of my earlier questions here we have a three-staged two-tier SharePoint farm. Each server with SharePoint 2019 Standard with a High Trust Provider Hosted App. The goal was to achieve SSO with Azure AD. SSO for DEV stage works quite well (besides the fact that the PHA doesn't use the SSO, but that's another story). Unfortunatel in TEST and PROD stage the SSO only works if the user authenticates via https://myapps.microsoft.com and hits the wanted application. Using the direct URL (like https://sp-dev.DOMAIN.com) leads to the default sign-in window / pop-up to enter the credentials instead of the Microsoft provided login screens. I've followed this tutorial: https://docs.microsoft.com/en-in/azure/active-directory/saas-apps/sharepoint-on-premises-tutorial.
The trusted identity provider configration looks like this:
$realm = "urn:sharepoint:test" $wsfedurl="https://login.microsoftonline.com/TENANT_ID/wsfed" $filepath="E:\Certificates\SharePoint TEST.cer" $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($filepath) New-SPTrustedRootAuthority -Name "AzureAD-SSO" -Certificate $cert $map = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" -IncomingClaimTypeDisplayName "name" -LocalClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" $map2 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" -IncomingClaimTypeDisplayName "GivenName" -SameAsIncoming $map3 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" -IncomingClaimTypeDisplayName "SurName" -SameAsIncoming $map4 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "Email" -SameAsIncoming $map5 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" -IncomingClaimTypeDisplayName "Role" -SameAsIncoming $ap = New-SPTrustedIdentityTokenIssuer -Name "AzureAD-SSO" -Description "SharePoint secured by Azure AD" -realm $realm -ImportTrustCertificate $cert -ClaimsMappings $map,$map2,$map3,$map4,$map5 -SignInUrl $wsfedurl -IdentifierClaim "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"