Yvand/EntraCP

Issue with Azure AD/CP authentication

Closed this issue · 9 comments

jonah406 commented

We have a number of SP2019 farms, that all use multi authentication methods, Windows AD/Azure AD. Each farm has Azure CP installed.

We currently have an issue with our Nintex workflow estate, whereby any WF with a State Machine/Pause action is causing a delay on the SP timer service. We have carried out a deep investigation with MS, and they have discovered that their is a timely query being done to Azure AD when trying to resolve an email address.

They have recommended that we temporarily disable Azure CP to see if this resolves the issue. Is this even an option when using Azure AD, and what is the likely impact on the overall farm?

Many thanks

Scott

Yvand commented

@jonah406 do the SharePoint logs show any AzureCP error/exception?
You can filter the SharePoint logs on product/area AzureCP to validate this.

To answer your question: SharePoint farm can work without AzureCP, but you will lose some features like the search in people picker.
If you want to disable AzureCP in a way that can be easily reversed, you can use the script below to de-associate it from your SPTrustedIdentityTokenIssuer:

# Set private member m_ClaimProviderName to null. Note that using .NET reflection on SharePoint objects is not supported and you do this at your own risks
$trust = Get-SPTrustedIdentityTokenIssuer "SPTRUST NAME"
$trust.GetType().GetField("m_ClaimProviderName", "NonPublic, Instance").SetValue($trust, $null)
$trust.Update()
julmsy commented

Hi,

Yes, logs should be a good start.
Also, please describe a little bit your configuration: is your servers access to internet through a proxy? If yes, could you please confirm that you added proxy configuration properly as described on AzureCP site?

jonah406 commented
Yvand commented

@jonah406 the exact opposite of the script I sent you is this one:

$trust = Get-SPTrustedIdentityTokenIssuer "SPTRUST NAME"
$trust.ClaimProviderName = "AzureCP"
$trust.Update()

But I encourage you to read https://azurecp.yvand.net/docs/usage/install/ to get all the information about the installation

jonah406 commented
Yvand commented

@jonah406 I fully understand your concerns.
The 2 scripts I provided in this discussion (to deactivate / reactivate AzureCP) are pretty safe, in the sense that one does exactly the opposite of the other, and they do not trigger the deployment of any file (which is the pain point in SharePoint)

jonah406 commented
Yvand commented

The commands I provided in my previous messages are farm wide and will apply to the whole farm, so they need to be run only 1 time, on any SharePoint server

stale commented

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.