Skip to content
Get packs

Guide · Agent skill

How to use the SAML Azure AD identity federation agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This page explains how to install and use the building-identity-federation-with-saml-azure-ad agent skill, which helps an AI agent plan and configure SAML 2.0 federation between on-premises Active Directory and Microsoft Entra ID (formerly Azure AD). It is written for people who have not used agent skills before. After reading it, you will know what the skill does, how to add it to Claude, how to ask for help in plain language, and what to check before running anything that changes a live domain.

SAML Identity Federation with Azure ADmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder. Confirm that SKILL.md sits inside the building-identity-federation-with-saml-azure-ad folder.
  2. 2Or upload it in the Claude apps. If you use the Claude apps, open Settings, go to Capabilities, then Skills, and upload the skill.
  3. 3Check the prerequisites. Confirm you have an Entra ID tenant, AD FS or a third-party SAML IdP, a public TLS certificate and DNS records for the federation service name.
  4. 4Ask a planning question. Describe your environment and goal in plain language, such as wanting users to sign in to cloud apps with on-premises credentials, and ask the agent to recommend a federation model.
  5. 5Review before you change anything. Have the agent explain each PowerShell step. Test in a non-production environment before running any command that changes domain federation settings.

What this skill makes the agent do

Once installed, the agent can walk you through designing and configuring single sign-on that links your on-premises Active Directory, either through AD FS or a third-party identity provider, to Microsoft Entra ID. It explains the four federation models in the skill: federated through AD FS, managed with password hash sync, managed with pass-through authentication, and third-party federation.

The skill also covers the SAML login flow and the trust components involved, including the token-signing certificate, federation metadata, relying party trust, claims rules and issuer URI. For setup, it provides PowerShell steps. It also includes Python scripts that can read Azure AD federation metadata and audit a federation configuration.

  • Explains which federation model fits a given requirement
  • Describes the SAML authentication flow from user to cloud app and back
  • Provides AD FS, Microsoft Graph PowerShell and claims-rule examples from its workflow
  • Includes a template for recording federation settings, claims rules and validation results

How to install the skill

Download the ZIP file from this page. Unzip it into one of two locations: your personal skills folder at ~/.claude/skills/, or a project-specific .claude/skills/ folder inside the project you are working in. The skill folder is named building-identity-federation-with-saml-azure-ad and contains SKILL.md at its root.

If you use the Claude apps instead of a local setup, open Settings, go to Capabilities, then Skills, and upload the skill there.

  • Personal install: ~/.claude/skills/building-identity-federation-with-saml-azure-ad/
  • Project install: .claude/skills/building-identity-federation-with-saml-azure-ad/ inside your project
  • Claude apps: Settings → Capabilities → Skills → upload

How to trigger it with natural requests

You do not need a special command. The skill's description says it applies when you are extending on-premises authentication to cloud resources or designing hybrid identity SSO for Entra ID, so ask in those terms. Mention the outcome you want, the systems you have, and whether you are planning, configuring or reviewing.

Give the agent the context it needs: which identity provider you use, whether you have AD FS or a third-party IdP such as Okta or Ping, and whether password hash sync or pass-through authentication is already in place.

  • 'I have on-prem AD and want users to sign into Microsoft 365 with the same passwords through AD FS. Walk me through the federation model choice.'
  • 'Explain the SAML login flow between our AD FS farm and Entra ID so I can document it.'
  • 'Review our claims rules and tell me which attributes are mapped to the NameID.'
  • 'Plan a hybrid identity SSO design for a company that must keep authentication on-premises.'

What you need before you start

The skill lists its prerequisites in SKILL.md. The setup steps need an on-premises Active Directory domain, AD FS on Windows Server or a third-party SAML IdP, a Microsoft Entra ID tenant (the skill recommends a P1 or P2 license), a public TLS certificate for the federation endpoint, and DNS records for the federation service name. Azure AD Connect is listed if you want password hash sync as a backup.

The auditor scripts need Python 3 with the requests, msal and cryptography packages, plus an Azure app registration with a client ID and client secret that has the Graph permissions the script needs. The PowerShell steps need the Microsoft.Graph module.

  • On-premises Active Directory domain
  • AD FS (the skill's prerequisites state a minimum version, so check SKILL.md) or a third-party SAML IdP
  • Microsoft Entra ID tenant (P1 or P2 recommended)
  • Public TLS certificate and DNS records for the federation service name
  • Python 3 with requests, msal and cryptography for the auditor script
  • Azure app registration with client ID, client secret and Graph permissions
  • PowerShell with the Microsoft.Graph module
pip install msal requests cryptography

Safety notes: scripts and network access

This skill runs scripts and uses the network. The Python auditor reads federation metadata from Azure AD, and the PowerShell steps change domain federation settings. The skill's own notes say that running these steps incorrectly can affect sign-in for an entire organization.

Do not run the domain-changing steps in production without a review. Test in a non-production tenant first, read every command before running it, and keep a record of the current settings so you can compare before and after.

  • The domain-level command New-MgDomainFederationConfiguration changes federation for a whole domain
  • Read-only checks such as metadata reads are lower risk, but still use network access and credentials
  • Keep client secrets out of shared files and rotate them according to your own policy
  • Have a rollback plan and an administrator who can revert sign-in settings
Connect-MgGraph -Scopes "Domain.ReadWrite.All"

Tips for better results

Ask the agent to explain the choice before it generates commands. A federation model decision affects who holds authentication authority, so it is worth confirming the reason for AD FS, pass-through authentication or password hash sync before moving on.

If you are reviewing an existing setup, paste the relevant configuration details, such as the claims rules and the federation settings, and ask for an audit against the trust components. Use the template in assets/template.md to keep the results organized.

  • Name your exact identity provider and Entra ID license level
  • Ask for explanations and checklists first, scripts second
  • Ask the agent to flag any step that changes live sign-in
  • Keep the template fields filled in as you go so the audit trail is complete

What people use it for

  • Planning a hybrid identity SSO design for an organization that must keep authentication on-premises through AD FS
  • Choosing between password hash sync, pass-through authentication and third-party federation for a Microsoft 365 rollout
  • Documenting the SAML login flow and trust components for an internal security review
  • Checking a federation configuration with the auditor script by reading Azure AD federation metadata

Frequently asked questions

How do I install the saml azure ad federation agent skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or a project's .claude/skills/ folder for one project. In the Claude apps, upload it under Settings, then Capabilities, then Skills.

What do I need to run this skill?

You need an on-premises Active Directory domain, AD FS or a third-party SAML IdP, and a Microsoft Entra ID tenant. The auditor scripts also need Python 3 with requests, msal and cryptography, an Azure app registration, and the Microsoft.Graph PowerShell module for the setup steps.

Is this skill free to use?

The skill is licensed under Apache-2.0, as listed on this page. The skill does not set a price, but Microsoft Entra ID licensing is separate: the skill recommends a P1 or P2 license for the tenant.

What are the alternatives to AD FS for Entra ID sign-in?

The skill's federation models table lists password hash sync, pass-through authentication and third-party federation through an external IdP such as Okta or Ping. The skill does not compare these options on cost or effort, so use its table to match each model to your requirements.

Can this skill break sign-in for my whole organization?

It can if the domain federation steps are run incorrectly. The skill warns that these PowerShell steps modify domain federation settings, so test in a non-production tenant and review each command before running it in production.

Why does the agent not trigger or give useful answers?

Make sure the skill folder is in the correct location and contains SKILL.md at its root. Then describe your goal in terms of extending on-premises authentication to cloud resources or designing hybrid SSO for Entra ID, and include your identity provider and license details.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits identity or IT engineers planning a hybrid AD to Entra ID SSO deployment, security teams reviewing an existing AD FS or SAML federation, and students learning how hybrid identity works. It is a poor fit for teams that want unreviewed production changes or organizations that lack an Entra ID tenant and an AD FS or third-party IdP, since the prerequisites cannot be met.

Download the skill