SOLVED OOBE with a federated domain user fails

[Bhatsy]

Hi We are running Autopilot in our environment and running into an issue.
Below is our setup
Intune Tenant: azureadonly.onmicrosoft.com
Federated domain: azuread-only.com (Federates to a passwordless IdP)

The machine boots up and gets to the custom branded page where the user is asked to login. When the user enters an onmicrosoft.com email address the screen moves to the next screen as presents a password prompt. However, when the user enters the federated domain email address (Domain verified on Azure AAD) the error " We didn't find that email address in your organization. Use another email address or contact your admin". Attached are fiddler traces. The trace shows the machine is trying to connect to intune at onmicrosoft.com tenant. How do we verify the federated domain in Intune like the way we have verified it on Azure. Seems like Intune doesnt recognize users that are on the federated domain.

 

[MJ-Tech]

• Go to Active directory users and domain
• find the user
• properties -> Attribute editor tab -> edit proxyAddresses
• Add this entry - SMTP:<email address>
• Apply and click ok.

Once the above steps are done, run the full synchronization. (Ensure the user OU is added in the container)


Next, go to Azure AD and verify the user principal name . it should reflect to correct domain name.

Try login .

 

[Bhatsy]

Hi Muneer. Thank you so much for responding. This is an azure only tenant. There is no on prem active directory. The user is created as Is there any other attribute I can modify for this user on Azure AD? Also, the only difference is that azuread-only.com is not a managed domain. Its a federated domain federated to a 3rd party idP over SAML.

 

[Bhatsy]

Just wanted to close the loop on this one if anyone needs help on this. We fixed this issue by using WS FED based federation instead of SAML. Microsoft clearly has some bugs they need to address with SAML based federations to 3rd party IdP.