I am configuring a SharePoint 2019 on premise instance using Azure AD SSO with AzureCP claims based authentication.
When a user signs into a SP2019 site with SSO, it creates a new SPUser with account name "xxx|TrustedString|[email protected]". The user's email is set to the email and display name attributes. I want to be able to sync all user attributes from Azure AD.
We use Windows AD synced to Azure AD with AD Connect. I can use the User Profile Service to sync properties from AD (users with account name "DOMAIN\samAccount"), but I cannot figure out how to do the same for AAD SharePoint users. Is this managed in claims mapping in my SPTrustedIdentityTokenIssuer? Do I need to write a script that manually syncs what I need?
I used the following as a guide to setup SSO initially: