Question

Your company uses a SaaS HR application that supports SAML 2.0 single sign-on. You add the application from the Microsoft Entra gallery and configure SAML-based SSO. The vendor requires that the user's employee ID (stored in the Entra ID extension attribute) be sent as the NameID in the SAML assertion instead of the default user principal name. Users can authenticate but the HR app rejects the sign-in because the NameID value does not match its expected identifier format. What should you do to resolve the issue?

Accepted Answer

Edit the SAML SSO configuration and change the Unique User Identifier (Name ID) attribute to map to the extension attribute containing the employee ID.

Answer

Configure a claims mapping policy and assign it to the managed identity of the enterprise application.

Answer

Change the single sign-on mode of the enterprise application from SAML to password-based SSO.

Answer

Add an app role in the app registration that returns the employee ID as a role claim.