I am configuring a SharePoint 2019 on premise instance using Azure AD SSO with AzureCP claims based authentication.

When a user signs into a SP2019 site with SSO, it creates a new SPUser with account name "xxx|TrustedString|[email protected]". The user's email is set to the email and display name attributes. I want to be able to sync all user attributes from Azure AD.

We use Windows AD synced to Azure AD with AD Connect. I can use the User Profile Service to sync properties from AD (users with account name "DOMAIN\samAccount"), but I cannot figure out how to do the same for AAD SharePoint users. Is this managed in claims mapping in my SPTrustedIdentityTokenIssuer? Do I need to write a script that manually syncs what I need?

I used the following as a guide to setup SSO initially:


1 Answer 1


Synchronize with Active Directory using the TIP as the UPSA data source. See Creating user profile for (SAML) claims users in sharepoint 2013.

As a side note, I would generally not recommend a SAML configuration due to the UX issues/administration issues it presents. With Azure AD, you can use the Azure App Proxy and configure SharePoint to use KCD (which is a good idea, anyways).

  • Thank you, this worked. I also needed to change the UPSA mapping "Claims User Identifier" to match my SPTrustedIdentityTokenIssuer primary claim mapping. Mar 11, 2021 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.