SharePoint 2019 Server - How do you sync user attributes from Azure AD into SPUser?

Question

I am configuring a SharePoint 2019 on premise instance using Azure AD SSO with AzureCP claims based authentication.

When a user signs into a SP2019 site with SSO, it creates a new SPUser with account name "xxx|TrustedString|[email protected]". The user's email is set to the email and display name attributes. I want to be able to sync all user attributes from Azure AD.

We use Windows AD synced to Azure AD with AD Connect. I can use the User Profile Service to sync properties from AD (users with account name "DOMAIN\samAccount"), but I cannot figure out how to do the same for AAD SharePoint users. Is this managed in claims mapping in my SPTrustedIdentityTokenIssuer? Do I need to write a script that manually syncs what I need?

I used the following as a guide to setup SSO initially:

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/sharepoint-on-premises-tutorial#:~:text=To%20configure%20Azure%20AD%20SSO,SAML%20mode%20to%20enable%20SSO.

Answer 1

Synchronize with Active Directory using the TIP as the UPSA data source. See Creating user profile for (SAML) claims users in sharepoint 2013.

As a side note, I would generally not recommend a SAML configuration due to the UX issues/administration issues it presents. With Azure AD, you can use the Azure App Proxy and configure SharePoint to use KCD (which is a good idea, anyways).