Microsoft Azure AD Mailbag: Hybrid Identity and ADFS

Datetime:2016-08-23 03:38:59         Topic: Windows Azure          Share        Original >>
Here to See The Original Article!!!

Hey there, this is Ramiro Calderon from the Azure AD Customer Success Team. Remember us? We took a brief hiatus (sorry about that) but now we are back! I wanted to write up some answers to common AD FS questions we get in the context of hybrid identity with Azure AD. Let’s get into it.

Question 1:

I have multiple root domains in my on-premises environment and child domains on each of them (,, and How do I set the AD FS issuance rules for Azure AD?

Answer 1:

You can do this in three steps:

1. Register Root Domains First ( and, so you share the federation configuration with all subdomains

2. If you have multiple root domains, you must use the –SupportsMultipleDomains when configuring the rules. This will create the base ADFS rules that generate the issuer claim

3. We are not done quite yet. Now, we have to make sure the child domains get the issuer consistent with the configuration above. All child domains on * should have the issuer of and all child domains on * have to have the issuer of Replace the default rule generated for the issuer claim and replace it with custom rules (one for each root domain, as shown below).


Put your ads here, just $200 per month.