I successfully configured Azure to work with an external IdP according to https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-saml-idp However if I try to do an IdP initiated login, it seems that the SSO service https://login.microsoftonline.com does not parse the RelayState accordingly to http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0-cd-02.html#5.1.4.IdP-Initiated%20SSO:%20%20POST%20Binding|outline

If I use the IdP initiated login URL:


the login works fine, but then I get redirect to https://www.office.com/?auth=2&home=1

If I finally type https://portal.azure.com in the same browser tab, I can access the Azure portal due to already successfully logged in via SSO.

Does anybody know why the Micrsoft SSO ignores the RelayState argument?

Cheers Jonas


We are currently facing more or less the same problem. We always end up on office.com after the login redirect from the Keycloak SAML Client URL. We tried some tests with Smart URLs as described here: http://www.enowsoftware.com/solutions-engine/using-smart-links-to-improve-the-login-process-to-office-365-applications but sadly these URLs are ignored by login.microsoft.com if the Login is done via POST which is the case when Keycloak handles the Federated Login.

However our solution was: If the user clicks on your page and requests a Azure Login, we open the Keycloak Azure Samle Client URL in a hidden iframe. If the frame has loaded (and redirected to Office.com) we send the user to portal.azure.com, which now has valid login credentials set and will login the user. A bit hacky but it works fine.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.