Migrating AGOL SAML Identity Provider from on-premise ADFS to Azure ADFS

Question

We are looking at switching the single sign-on identity provider that our organizational AGO account uses from our on-premise ADFS server to Azure ADFS and are wondering if that can be a seamless transition if the NAMEID is the same in both configurations. We're hoping that accounts will persist after we switch and we won't need to modify ownership and/or group membership.

Thanks for any information, site, or personal experience!

Configure Active Directory Federation Services—ArcGIS Online Help | Documentation

Azure Set-Up: Tutorial: Azure Active Directory integration with ArcGIS Online | Microsoft Docs

GeraldCoates1 · Answer

Thanks for the info.  You are correct.  We made the change and did not have to create new accounts.  There was a couple of settings that we had to change on the Azure ADFS connection but everything worked.  Thanks for taking the time to respond.

EdgarWIparraguirre · Answer

As long as the NameID claim definition does not change, there is no need to create new users. I guess it is safe to say that de username in AGOL/Portal is nothing else than the NameID. On ADFS / Azure AD NameID is normally coupled to the UserPrincipalName (most of the times equal to the e-mail address but not neccessarily).

MatthewRantala1 · Answer

Good luck!

As I mentioned above, I didn't do the work myself, but since we were able to essentially replicate our ADFS configuration in Azure, it did work seamlessly. If I understood right, our email address basically was our key identifier. We did test on our portal installation first so whatever minor quirks existed were figured out before trying AGO.