ADFS 2.0 asserts the immutableID value in its SAML assertion during Federation attempts with Office 365.
The ImmutableId is specified at object create time in Office 365. If you use DirSync, the objectGUID is used.
If you have many AD forests that you wish consolidated to one O365 instance, DirSync is not really an option.
So if you can get your users into O365, and set a proper UPN, and ImmutableId, will ADFS be happy? And what format for the objectGUID value (A non-string value, octet/binary, whatever you wish to call it) should be passed when creating your user?
- String based GUID representation
- Base64 encoded binary value
It is easy enough to do either in my case, I just need to know what ADFS is using in its assertion in its basic or default configuration for this support?