Our migration from ADFS to Entra ID: The two show-stopper bugs we hit.

Our organization recently completed a migration from an on-premises ADFS setup to Microsoft Entra ID to serve as the primary identity provider for our SaaS HR platform and internal applications. The overall process is well-documented, but we encountered two significant, less-discussed bugs that caused major delays. I'm detailing them here for the benefit of others planning a similar migration.

The first issue involved **SAML token lifetime mismatches causing abrupt session termination**. Our HR application has a session timeout of 120 minutes. We configured `TokenLifetime` policies in Entra ID accordingly. However, users were being logged out after exactly 60 minutes. After extensive testing and a support ticket, we discovered the root cause:

* The SAML token issuance process was using a **different, undocumented policy** for the SAML assertion's `NotOnOrAfter` value, which was defaulting to 60 minutes.
* This setting was not exposed in the portal UI and was not overridden by the configured `TokenLifetime` policies, which applied to OAuth tokens but not SAML.
* The fix required a PowerShell script to manually set the `SamlTokenVersion` property on the enterprise application's token issuance policy.

The second, more complex problem was related to **group claim transformations failing with nested groups**. We have a complex organizational structure with nested Active Directory groups synced to Entra ID. Our application relies on specific group claims to determine authorization.

* When we configured the application to emit group claims, we used the "Groups assigned to the application" option and selected "Security Groups" with the `sAMAccountName` attribute.
* For users in nested groups, the claim often arrived empty or contained only the immediate parent group, not the ultimate parent group that the application's logic required.
* The issue was traced to a mismatch between the group expansion process and the attribute sourcing. The `sAMAccountName` for synced groups was not consistently available in the cloud context for nested memberships during token issuance.
* We resolved this by switching to emit group claims as **Object IDs** and modifying our application's authorization logic to compare against known group GUIDs instead of names, which proved more reliable.

Both issues required deep diagnostics and were not apparent during initial testing. The key takeaway is that while moving from ADFS to Entra ID simplifies many aspects, the configuration nuances for SAML and complex group claims require careful validation beyond the standard migration guides. I strongly recommend building extra time into your migration schedule for testing scenarios involving nested group memberships and long-duration sessions with SAML applications.