<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>I am getting close. What you are using for the FederationMetadataUrl ?<br>

<div><br></div></div></div></blockquote><div><br>I&#39;m not.... the o365 metadata is stored in a FilesystemMetadataProvider...<br><br>    &lt;!-- Azure for Office 365 --&gt;<br>     
 &lt;metadata:MetadataProvider id=&quot;AzureLocal&quot; 
xsi:type=&quot;FilesystemMetadataProvider&quot; 
xmlns=&quot;urn:mace:shibboleth:2.0:metadata&quot;<br>               metadataFile=&quot;/opt/shibboleth-idp/metadata/azure-metadata.xml&quot;&gt;<br>         &lt;metadata:MetadataFilter xsi:type=&quot;ChainingFilter&quot; xmlns=&quot;urn:mace:shibboleth:2.0:metadata&quot;&gt;<br>

            &lt;metadata:MetadataFilter xsi:type=&quot;EntityRoleWhiteList&quot; xmlns=&quot;urn:mace:shibboleth:2.0:metadata&quot;&gt;<br>               &lt;metadata:RetainedRole&gt;samlmd:SPSSODescriptor&lt;/metadata:RetainedRole&gt;<br>

            &lt;/metadata:MetadataFilter&gt;<br>         &lt;/metadata:MetadataFilter&gt;<br>      &lt;/metadata:MetadataProvider&gt;<br> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">

<div dir="ltr"><div><div><br></div>Would you mind sharing how you are releasing attributes? In my idp-process.log i get:<br></div></div></blockquote></div><br></div><div class="gmail_extra">from my attribute-filter.xml...<br>

<br>  &lt;!-- Attribute Filter Policy for Windows Azure AD --&gt;<br>   &lt;afp:AttributeFilterPolicy id=&quot;PolicyForWindowsAzureAD&quot;&gt;<br>      &lt;afp:PolicyRequirementRule xsi:type=&quot;basic:AttributeRequesterString&quot; value=&quot;urn:federation:MicrosoftOnline&quot; /&gt;<br>

         &lt;!-- Release userPrincipalName as Windows Azure AD User ID --&gt;<br>      &lt;afp:AttributeRule attributeID=&quot;UserId&quot;&gt;<br>          &lt;afp:PermitValueRule xsi:type=&quot;basic:ANY&quot;/&gt;<br>
      &lt;/afp:AttributeRule&gt;<br>
         &lt;!-- Release Immutable ID to Windows Azure AD --&gt;<br>      &lt;afp:AttributeRule attributeID=&quot;ImmutableID&quot;&gt;<br>          &lt;afp:PermitValueRule xsi:type=&quot;basic:ANY&quot;/&gt;<br>      &lt;/afp:AttributeRule&gt;<br>

         &lt;!-- Note: it is not recommended to send transientId to Windows Azure AD --&gt;<br>      &lt;afp:AttributeRule attributeID=&quot;transientId&quot;&gt;<br>          &lt;afp:DenyValueRule xsi:type=&quot;basic:ANY&quot;/&gt;<br>

      &lt;/afp:AttributeRule&gt;<br>   &lt;/afp:AttributeFilterPolicy&gt;<br><br></div><div class="gmail_extra"><br clear="all"></div><div class="gmail_extra"><br>-- <br><div dir="ltr"><div>Robert W. Gorrell<br>Systems Architect, Identity and Access Management </div>


<div>University of NC at Greensboro<br><span style="white-space:nowrap">336-334-5954</span><br>PGP Key ID B36DB0CA<br></div></div>
</div></div>