IDP SAML authentication redirects to ADFS

Question

Hi,

We have few SAML configuration in the Azure AD for different applications and we see that all the authentication is redirected to ADFS even though it initially starts with the Microsoft login portal.

I see few months back there was a similar question and gone through that but still couldn't wrap my mind around the guest user that is referred there.

https://learn.microsoft.com/en-us/answers/questions/969280/external-idp-saml-authentication-redirect-to-adfs

If the guest user here is in reference to user type, then the users I'm talking about have Member in their user types. And not only the applications SAML configurations but even when I try to login to Azure AD it shows the same behavior.

Can you give more details so I can understand better.

Answer 1

@Kavya Imandi

This happens because your Azure AD domain is federated with ADFS. Let's take a scenario where you have 2 custom domain in Azure AD, DomianA.com and DomainB.com. Out of these domains you have DomainA.com as federated with ADFS. This means any user who has UPN suffix as "@domainA.com" will be redirected to ADFS for authentication.

Now, whenever user with UPN suffix "@domainA.com" tries to access any application which is configured in Azure AD, they will be redirected to ADFS for authentication. Basically user tries to access the application, Application redirects the request to Azure AD. Azure AD will prompt for credentials. When user enters the UPN with suffix "@domainA.com", Azure AD will check its database and know that this domain is federated. So Azure AD will forward the request to ADFS for authentication.

This happens with any protcol (SAML, OIDC) that application is using. First the request lands to login.microsoft.com endpoint. this is Azure AD authentication endpoint. Once user enters there UPN, the request is redirected to ADFS for authentication.

Let me know if you have any further questions on this.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.