Migrating SSO from ADFS to AzureAD/EntraID - Overwrite your Linked Identity

[dmei4]

Select Topic Area

Question

Body

Right now I'm in the process of moving ADFS services to Azure/EntraID. Our test organization is cutover and I had a few users sign in to see if there is any issues with the cutover process. I thought emails associated would be case insensitive. This doesn't seem to be the case. One of the users got the following message.

Just want to know if this would break their previous access?

Overwrite your linked identity?

You previously accessed this organization with Firstname.Lastname@company.com as your SAML identity. You've now signed in with firstname.lastname@company.com - this account may not have access to the same data in the Company organization.

Are you sure you want to sing in with this new SAML identity

Go back to single-sign on
Overwrite and continue

Note: If you are signed with firstname.lastname@company.com in your identity provider browser, you may need to sign out of your identity provider before you can sign in again with Firstname.Lastname@company.com

[queenofcorgis]

Thanks for posting this here @dmei4 , I'm going to highlight this in the Enterprise category roundup to see if we can get some additional eyes on this to assist!

[Jamonygr]

I would be careful with that prompt. It means GitHub sees the new Entra SAML NameID as a different linked identity from the old ADFS one, even if it only differs by email casing. Before users click overwrite in production, I would make the Entra NameID claim match the old ADFS value exactly, including case if possible, and test with a small group. Overwriting should not delete repositories, but it can change which external identity GitHub associates with that user for SSO, which is exactly the kind of thing you want stable during a cutover.