This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(80, 32%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
I need to configure Azure AD as a SAML Identity Provider for my service which works fine. But I need to also configure holder of key as depicted in standard http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-holder-of-key-browser-sso-cs-02.pdf.
Can someone please point me to relevant documentation?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGM%3C/text%3E%3C/svg%3E)
@SHOBHANK SHARMA Thank you for reaching out to us, As I understand you have query related to Azure AD supports SAML Holder of key or not ?
Following are three certificate signing options Azure AD supports:
Sign SAML assertion - This default option is set for most of the gallery applications. If you select this option, Azure AD as an Identity Provider (IdP) signs the SAML assertion and certificate with the X.509 certificate of the application.
Sign SAML response - If you select this option, Azure AD as an IdP signs the SAML response with the X.509 certificate of the application.
Sign SAML response and assertion - If you select this option, Azure AD as an IdP signs the entire SAML token with the X.509 certificate of the application.
Let me know if you have any further questions.
Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.
My question was not related to signing of SAML assertion or response. But the question is about support for holder of key.
Particularly from the standard I was looking for Azure AD as IDP to send hok assertion in response.
"The identity provider authenticates the principal by any method of its choosing and
then produces a response containing at least one assertion with holder-of-key subject confirmation and
an authentication statement for the user agent to transport to the service provider. "
@SHOBHANK SHARMA Apologies for misunderstanding your ask, Researched and discussed with my team as well, we do not support Azure AD SAML Holder of key as if now.
Noticed for similar ask feedback was posted https://feedback.azure.com/d365community/idea/a40eb779-be25-ec11-b6e6-000d3a4f0789 and you can upvote and add your business justification to the same which is closely monitored by our product group team.
Let me know if you have any further questions.
@SHOBHANK SHARMA Just checking in to see if above information was helpful. If you have any further questions on this issue, please feel free to post back.
