1.4.2. SAML and WS-Fed
💡 First Principle: Federation protocols solve trust between organizations and products that don't share a directory: the identity provider and the application agree on certificates and endpoints in advance, then exchange signed XML assertions about who authenticated. SAML 2.0 (and its older Microsoft cousin WS-Fed) predate OAuth/OIDC — and thousands of established SaaS apps still speak only SAML.
For the SC-300, SAML is not history; it's Tuesday. Configuring gallery apps for SAML-based single sign-on (Phase 4) and federating with an external SAML/WS-Fed identity provider for B2B guests (Phase 3) are both live exam objectives. The working vocabulary: the identity provider (IdP) — Entra ID in most scenarios — authenticates the user and issues a signed assertion; the service provider (SP) — the app — validates the signature and admits the user. Claims inside the assertion (UPN, email, groups) map the user to an app-side account, and a shared signing certificate underwrites the whole trust — when it expires, SSO stops for everyone at once.
| Aspect | SAML 2.0 / WS-Fed | OAuth 2.0 + OIDC |
|---|---|---|
| Format | XML assertions | JSON web tokens (JWT) |
| Primary job | Web single sign-on (federation) | API authorization + sign-in |
| Typical use on exam | Gallery SaaS SSO, external IdP federation | Microsoft Graph, app registrations, consent |
| Mobile/API fit | Poor | Native |
| Trust anchored by | Exchanged signing certificates | Published signing keys (OIDC metadata) |
Direction matters and stems will flip it on you: when your workforce signs in to Salesforce, Entra is the IdP and Salesforce the SP; when a partner's users federate into your tenant as guests, their IdP authenticates and your tenant plays the relying side of the trust.
⚠️ Exam Trap: SAML signing certificates expire (Entra defaults to three years). "Users suddenly can't SSO into one specific SaaS app, but can access everything else" is the signature symptom — renew/rotate the certificate on both sides, don't reset passwords.
Reflection Question: Why does an expired SAML signing certificate break sign-in to that one app while OAuth-based apps in the same tenant keep working?