We are replacing our native Sitecore authorization and user management in our customer portal with Azure AD. We would like Azure AD to also provide some profile data (we will probably extend the schema), as well as controlling membership of Sitecore security roles based on a combination of Azure AD group membership and profile data. Our aim is to operate with virtual users, with an extremely limited shadow in Sitecore where necessary (e.g. some application preferences).

Our requirements include:

  1. Support for multiple domains (e.g. ourcompany.com, ourcompany.dk, ourcompany.de)
  2. Server side connection to external web services (probably RESTful) that are protected by the same Azure AD authorization and provide user specific data
  3. Client side connection to these same services (e.g. as an AJAX request) from within Sitecore pages
  4. Single Sign On (log in to all sites/services one-time) would be nice to have, seamless experience of the data feeds in point 3 is essential.
  5. Execute business logic on log-in to determine which Sitecore security roles an authorized acount should belong to

While we wait for Azure AD to be integrated into Sitecore 8.3 (according to the road map) there are numerous approaches available, and various modules/code examples provided.

To quickly list a few options:

  1. Using Azure AD domain services to clip into the Sitecore AD module
  2. Using Azure AD B2C with OAUTH
  3. Using the ADFS module
  4. Using the OWIN federated indentity module

What are the most robust approaches/technologies (provide flexibility, transparency of implementation and management, minimal workarounds/hacks, open-endedness) for implementing an architecture that supports this?

What are the typical challenges we can expect to face with them?

1 Answer 1


I cannot give you a detailed answer but you should know that in the future (not yet scheduled) the AD module will be retired and Sitecore will move away from the Microsoft Membership model and towards Microsoft Identity. This introduces support for the Microsoft.Owin authentication middleware. This can be used as a replacement for the AD module.

Owin middlewares available include:

  • OpenId Connect (AzureAD, Identity Server)
  • Microsoft Account
  • Google
  • Facebook
  • Twitter
  • WsFederation
  • OAuth
  • SAML (3rd party - not developed by MS)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.