Users can't sign-in with alternate ID - Troubleshooting Guide

Step 1

Do you use Azure AD Connect to manage your federation trust with Azure AD?

Azure Active Directory (Azure AD) Connect lets you configure federation with on-premises Active Directory Federation Services (AD FS) and Azure AD. Using Azure AD Connect can simplify configuring alternate ID.

Check: Azure AD Connect and Federation

Do you manage your federation trust with Azure AD Connect?

Yes No

Step 1

Ensure you have correct Azure AD Connect version

There have been several improvements made in Azure AD Connect for AD FS. Check that the version is 1.1.553.0 or latest.

Is the version 1.1.553.0 or latest?

Yes No

Step 1

Check for correct user principal name and source anchor attribute.

Open Azure AD Connect on the Azure AAD Connect server, and click on task View current configuration.

Ensure the attribute listed for userPrincipalName is set as the alternate ID attribute to be used from Active Directory
Ensure the attribute listed for sourceAnchor is set as the expected attribute to be used for immutable ID from Active Directory.

If they are not correct, please re-install Azure AD Connect with correct attribute mapping. Refer to Custom installation of Azure AD Connect for detailed information on configuration steps.

Does this solve the issue?

Yes No

Step 1

Check AD FS settings for alternate ID

Configure your AD FS claims provider trusts to enable alternate login ID

For Windows Server 2012R2, install KB2919355 . You can get it via Windows Update Services or download it directly.
Update the AD FS configuration by running the following PowerShell cmdlet on any of the federation servers in your farm (if you have a WID farm, you must run this command on the primary AD FS server in your farm): Set-AdfsClaimsProviderTrust -TargetIdentifier "AD AUTHORITY" -AlternateLoginID <attribute> -LookupForests <forest domain>
AlternateLoginID is the LDAP name of the attribute that you want to use for login.

LookupForests is the list of forest DNS that your users belong to.

To enable alternate login ID feature, you must configure both -AlternateLoginID and -LookupForests parameters with a non-null, valid value.

In the following example, you are enabling alternate login ID functionality such that your users with accounts in contoso.com and fabrikam.com forests can log in to AD FS-enabled applications with their "mail" attribute.
Set-AdfsClaimsProviderTrust -TargetIdentifier "AD AUTHORITY" -AlternateLoginID mail -LookupForests contoso.com,fabrikam.com
To disable this feature, set the value for both parameters to be null.
Set-AdfsClaimsProviderTrust -TargetIdentifier "AD AUTHORITY" -AlternateLoginID $NULL -LookupForests $NULL

Does this solve the issue?

Yes No

Step 1

Check claim rules on Azure AD RP trust

If you are using Azure AD Connect to manage your Azure AD trust with AD FS, it should generate the right set of claim rules automatically. To manually configure the right set of claims use Azure AD RPT Claim Rules, or to verify the claim rules use Claims X-Ray.

Does this solve the issue?

Yes No

Step 1

Check for correct user principal name and source anchor attribute.

Open Azure AD Connect on the Azure AAD Connect server, and click on task View current configuration.

Ensure the attribute listed for userPrincipalName is set as the alternate ID attribute to be used from Active Directory
Ensure the attribute listed for sourceAnchor is set as the expected attribute to be used for immutable ID from Active Directory.

If they are not correct, please re-install Azure AD Connect with correct attribute mapping. Refer to Custom installation of Azure AD Connect for detailed information on configuration steps.

Does this solve the issue?

Yes No

Step 1

Successful

Congratulations! Your issue has been solved.

Step 1

Problem not solved

We are sorry that the problem persists. We'd appreciate it if you can provide feedback with details of your issue so that we can improve the troubleshooting workflows.