I've managed to register new Trusted Identity Provider on my farm, and I'm using Azure ACS as the provider.

I have no issues adding yahoo and gmail users by their email addresses, but if I add a WLID user, I get the message that the site has not been shared with me (when I try to sign in). I went through the Sharepoint logs and saw that WLID returns IsAuthenticated=true, so I assume the issue is with the site privileges themselves.

When I copy the user id hash that WLID returns, and add that as an user to Sharepoint site (instead of email address), then I'm able to sign in. This is extremely inconvenient. I must be able to add users by their email addresses, on SP site.

I know WLID uses only nameidentifier as an input claim, but I created the rule on the ACS that's supposed to map incoming nameidentifier into the emailaddress claim. I assume I did something wrong, but not sure what.


ACS won't give you back the Windows Live email. It's been always like that :(

Here is a workaround using the Live API and some custom code


You can also try Auth0 which has SharePoint 2010 and 2013 support. It supports Windows Live giving back the email and many other providers. Configuration is easy since you download a PS script that will do the config for you. Here is a high level diagram of how it works.

Disclaimer: I work at Auth0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.