How to make Azure AD use SAML2

Question

I want to be able to use Azure AD with SAML2

To my understanding, the Azure AD will work as the IdP while I will host the STS myself

I have already set my application up to use Azure AD and SAML on their own. However, combining the two seems to cross some wires.

In my application's web.config, I have the following XML, which has worked with SAML:

  <sustainsys.saml2 entityId="https://saml-dc.qa.mycompany.com/Saml2/Acs" expectSignatureInXml="false" returnUrl="https://saml-dc.qa.mycompany.com" minIncomingSigningAlgorithm="SHA256" authenticateRequestSigningBehavior="Never">
<metadata cacheDuration="0:0:42" validDuration="7.12:00:00" wantAssertionsSigned="false">
  <requestedAttributes>
    <add name="Minimal" />
  </requestedAttributes>
</metadata>
<identityProviders>
  <add entityId="https://sts.windows.net/86e70697-498c-45e7-862a-c66e65ed3864/" signOnUrl="https://login.microsoftonline.com/86e70697-498c-45e7-862a-c66e65ed3864/saml2" allowUnsolicitedAuthnResponse="false" binding="HttpRedirect" loadMetadata="true" metadataLocation="https://login.microsoftonline.com/86e70697-498c-45e7-862a-c66e65ed3864/federationmetadata/2007-06/federationmetadata.xml?appid=9a8b9faf-9f86-4e98-806c-9c210642edec">
    <!--signingCertificate storeName="My" storeLocation="LocalMachine" findValue="myThumbprint" x509FindType="FindByThumbprint" /-->
  </add>
</identityProviders>

I get the following error when logging in:

AADSTS700016: Application with identifier ' https://saml-dc.qa.MyCompany.com/Saml2/Acs ' was not found in the directory '86e70697-498c-45e7-862a-c66e65ed3864'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant

The "MyCompany" is a substitute

I'm still quite new to using SAML - but I do grasp the basics of it. Please feel free to correct me, if what I'm stating above is unclear or erroneous.

Answer 1

Yes you can via a custom SAML connection.

Here's an example using ADFS.