We have ArcGIS enterprise 10.7.1 on premise and we configure a Single Sign On (SAML) using Azure Active Directory. Now AD user and email will change from firstname.lastname@example.org to email@example.com. And I need to know how this change that is coming will affect my implementation.
1. When SAML trust was created in Azure, an Enterprise application was created in azure. and we add users access privileges to this app. My question is after this AD changes are made, do I need to delete and recreate this APP or this app register automatically the changes?
2. If I do not recreate the app and see the changes smoothly, do I need to recreate the trust again between AZure AD and Portal?
3. If I do need to recreate this trust or if imagine that I do need to create this trust, What would happen to my users in Portal, would I have two of them, ex. firstname.lastname@example.org and after the new login Enterprise add email@example.com ? and if this happen, what would happen with the ownership of the items, i will need to change the ownership of the items? of can I create a mapping for this items.
I hope I explain myself correctly.
Thanks for all your help,
If the only thing changing is your users' email addresses, then my gut feeling is that you would not need to change anything in the Azure enterprise app. You may need to do something to make sure your users can still access your Portal. With SAML logins, Azure AD passes the UserPrincipalName on to Portal, so you will need to find out whether this is actually changing for your users. It is possible that your IT department will simply set up an email alias firstname.lastname@example.org while the actual underlying email address (and UserPrincipalName) in Azure AD still remains email@example.com. Basically, talk to your IT to get more information on this change.
If the actual email address is changing, then I would expect that IT will make sure that the same users will still be in your Azure AD enterprise application. In that case what you would need to do is change your Portal users to use the new email addresses - this may require some scripting if you have many of them.
I would tack onto what @NiekGoorman1 suggested with the following Admin API operation that would allow you to update the IDP username (value used to match the incoming SAML assertion Name ID attribute to the user within Portal). If the Name ID attribute is going to change, this would be a workaround that would prevent you from duplicating accounts and migrating content to the new account, but the username within Portal would not be updated.
Overall I think it would depend on the number of users to determine which direction you'll take when the cutover happens.
Update Enterprise User—ArcGIS REST API | ArcGIS for Developers