IdP Settings for ePO SSO in AD FS

[User86373889]

Which claim rules must be configured in AD FS to use with ePO IdP SSO?

[cdinet]

Is this for on prem or mvision epo?  I believe on-prem will only take/need the users email ID.

[User86373889]

It's a on prem epo installation.

Why there is no documentation about needed settings?

[cdinet]

Have you looked at the product guide?
https://docs.trellix.com/bundle/trellix-epolicy-orchestrator-on-prem-5.10.0-product-guide/page/GUID-...

[User86373889]

Yes, I read the guide, but there is no information about needed rules or other settings needed for AD FS

[cdinet]

Some of those have to come from your IDP - doc shows this...

For instructions on how to configure your IdP application, see your identity provider's documentation.

In the meantime, I am checking with one of my colleagues who is more familiar with this.

[User86373889]

But the IdP has no idea which answer expects epo.
Is it e-mail address, or SAM-Account-Name or something else?

For other systems using SAML we have always this information.

[cdinet]

I already explained that for AD it expects the email address.  I agree, we need some better instructions and I am working on getting that with someone with expertise in it.