# Facing Issues with MSOLService Deprecation — Best Practice for Azure SSO with OpenIAM? **URL:** \ **Category:** SSO\ **Created:** [July 14, 2025, 5:36am UTC](https://community.openiam.com/t/facing-issues-with-msolservice-deprecation-best-practice-for-azure-sso-with-openiam/157 "2025-07-14T05:36:22Z")\ **Posts on this page:** 11\ **Page:** 2
**Author:** ![straee](https://yyz2.discourse-cdn.com/flex010/user_avatar/community.openiam.com/straee/32/162_2.png) [@straee](https://community.openiam.com/u/straee)\ **Post date:** [September 2, 2025, 11:30pm UTC](https://community.openiam.com/t/facing-issues-with-msolservice-deprecation-best-practice-for-azure-sso-with-openiam/157/22 "2025-09-02T23:30:55Z")
Hi Dmytro, Are you referring to assigning the authentication provider to a resource within a role? If so, yes—the user has a role that has the authentication provider assigned to it. Best regards, Aaron ---
**Author:** ![straee](https://yyz2.discourse-cdn.com/flex010/user_avatar/community.openiam.com/straee/32/162_2.png) [@straee](https://community.openiam.com/u/straee)\ **Post date:** [September 10, 2025, 8:35am UTC](https://community.openiam.com/t/facing-issues-with-msolservice-deprecation-best-practice-for-azure-sso-with-openiam/157/23 "2025-09-10T08:35:44Z")
Hi Dmytro, I found a strange but repeatable behavior when trying to access Microsoft 365 via OpenIAM as the IdP. Here’s the scenario: 1. I’m already logged into OpenIAM in another tab (same browser session). 2. When I go to `https://portal.office.com`, I get redirected to OpenIAM’s login page: 3. On that page, I enter the username, but nothing happens — the password field doesn’t appear. 4. If I manually change the URL to: It seems like the SAML session is still active, and manually accessing the SAML endpoint bypasses the broken login flow. Is there an explanation for why the login page fails to render or redirect properly when accessed via the `postbackUrl` flow? Could this be a login template issue or something misconfigured in the redirect handler? Would appreciate any help or insight on how to fix this. Thanks, Aaron ---
**Author:** ![dsaburov](https://avatars.discourse-cdn.com/v4/letter/d/aeb1de/32.png) [@dsaburov](https://community.openiam.com/u/dsaburov)\ **Post date:** [September 10, 2025, 5:58pm UTC](https://community.openiam.com/t/facing-issues-with-msolservice-deprecation-best-practice-for-azure-sso-with-openiam/157/24 "2025-09-10T17:58:26Z")
Hi Aaron, I will discuss your question with our team, and will come back to you shortly. Best regards, Dmytro ---
**Author:** ![dsaburov](https://avatars.discourse-cdn.com/v4/letter/d/aeb1de/32.png) [@dsaburov](https://community.openiam.com/u/dsaburov)\ **Post date:** [September 15, 2025, 1:42pm UTC](https://community.openiam.com/t/facing-issues-with-msolservice-deprecation-best-practice-for-azure-sso-with-openiam/157/25 "2025-09-15T13:42:26Z")
Hi Aaron, Could you please share two screenshots from OpenIAM of uri patterns for: /idp/saml2/idp/login and /idp/saml2/idp/\* Best regards, Dmytro Please follow this path: webconsole → access control → content provider → your SAML connect provider → /idp/saml2/idp/login URI webconsole → access control → content provider → your SAML connect provider → /idp/saml2/idp/login\* URI ---
**Author:** ![straee](https://yyz2.discourse-cdn.com/flex010/user_avatar/community.openiam.com/straee/32/162_2.png) [@straee](https://community.openiam.com/u/straee)\ **Post date:** [September 16, 2025, 3:58am UTC](https://community.openiam.com/t/facing-issues-with-msolservice-deprecation-best-practice-for-azure-sso-with-openiam/157/26 "2025-09-16T03:58:59Z")
/idp/saml2/idp/\* ![cp1](https://canada1.discourse-cdn.com/flex010/uploads/openiam_community/original/1X/1d4df70beebb690d91f763761213bb94b1d5b7fe.png) ![cp2](https://canada1.discourse-cdn.com/flex010/uploads/openiam_community/original/1X/44415fab014067bb58fe1f0030981eb492ec6869.png) /idp/saml2/idp/login ![cp3](https://canada1.discourse-cdn.com/flex010/uploads/openiam_community/original/1X/5f1935c7181183f11ff8e95bbbc6fe344e1db497.png) ![cp4](https://canada1.discourse-cdn.com/flex010/uploads/openiam_community/original/1X/8e66bbc6907b2b05c09f0b74531097ddce62103c.png) ---
**Author:** ![dsaburov](https://avatars.discourse-cdn.com/v4/letter/d/aeb1de/32.png) [@dsaburov](https://community.openiam.com/u/dsaburov)\ **Post date:** [September 16, 2025, 8:17am UTC](https://community.openiam.com/t/facing-issues-with-msolservice-deprecation-best-practice-for-azure-sso-with-openiam/157/27 "2025-09-16T08:17:42Z")
Hi Aaron, Could you please change Supported Authentication levels for /idp/saml2/idp/login Should be: Any Authentication Best regards, Dmytro ---
**Author:** ![straee](https://yyz2.discourse-cdn.com/flex010/user_avatar/community.openiam.com/straee/32/162_2.png) [@straee](https://community.openiam.com/u/straee)\ **Post date:** [September 17, 2025, 1:59am UTC](https://community.openiam.com/t/facing-issues-with-msolservice-deprecation-best-practice-for-azure-sso-with-openiam/157/28 "2025-09-17T01:59:46Z")
Hi Dmytro, Thank you so much — it works now! Just one more thing: OpenIAM sends the User Principal Name to Entra ID in the SAML request, but Entra expects the `OnPremisesImmutableID`. Is there a Groovy script template available that retrieves the `objectGUID`of a user using the Azure AD connector and convert it to Base64 ? Best regards, Aaron ---
**Author:** ![dsaburov](https://avatars.discourse-cdn.com/v4/letter/d/aeb1de/32.png) [@dsaburov](https://community.openiam.com/u/dsaburov)\ **Post date:** [September 18, 2025, 6:58pm UTC](https://community.openiam.com/t/facing-issues-with-msolservice-deprecation-best-practice-for-azure-sso-with-openiam/157/29 "2025-09-18T18:58:54Z")
Hi Aaron, As I understand, you would like to have OpenIAM verify the user by OnPremisesImmutableID from Azure SAML request If yes, then you have to sync Azure users with OnPremisesImmutableID attribute using our PSGraph connector. Regarding configuration OpenIAM I will discuss it with our team. Best regards, Dmytro ---
**Author:** ![dsaburov](https://avatars.discourse-cdn.com/v4/letter/d/aeb1de/32.png) [@dsaburov](https://community.openiam.com/u/dsaburov)\ **Post date:** [September 23, 2025, 4:37pm UTC](https://community.openiam.com/t/facing-issues-with-msolservice-deprecation-best-practice-for-azure-sso-with-openiam/157/30 "2025-09-23T16:37:40Z")
Hi Aaron, I have a question: How should OnPremisesImmutableID be represented in OpenIAM’s SAML request to Azure, as NameID in SAML request or as an additional attribute in SAML request? Best regards, Dmytro ---
**Author:** ![straee](https://yyz2.discourse-cdn.com/flex010/user_avatar/community.openiam.com/straee/32/162_2.png) [@straee](https://community.openiam.com/u/straee)\ **Post date:** [September 23, 2025, 5:02pm UTC](https://community.openiam.com/t/facing-issues-with-msolservice-deprecation-best-practice-for-azure-sso-with-openiam/157/31 "2025-09-23T17:02:45Z")
Hi Dymtro, I believe it would be best if it’s represented as NameID instead! Best regards, Aaron ---
**Author:** ![straee](https://yyz2.discourse-cdn.com/flex010/user_avatar/community.openiam.com/straee/32/162_2.png) [@straee](https://community.openiam.com/u/straee)\ **Post date:** [October 10, 2025, 3:11am UTC](https://community.openiam.com/t/facing-issues-with-msolservice-deprecation-best-practice-for-azure-sso-with-openiam/157/32 "2025-10-10T03:11:01Z")
Hi Dmytro, Any updates on this yet? Best regards, Aaron [Previous page](https://community.openiam.com/t/facing-issues-with-msolservice-deprecation-best-practice-for-azure-sso-with-openiam/157.md?page=1)