Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.

1.4.2. SAML and WS-Fed

💡 First Principle: Federation protocols solve trust between organizations and products that don't share a directory: the identity provider and the application agree on certificates and endpoints in advance, then exchange signed XML assertions about who authenticated. SAML 2.0 (and its older Microsoft cousin WS-Fed) predate OAuth/OIDC — and thousands of established SaaS apps still speak only SAML.

For the SC-300, SAML is not history; it's Tuesday. Configuring gallery apps for SAML-based single sign-on (Phase 4) and federating with an external SAML/WS-Fed identity provider for B2B guests (Phase 3) are both live exam objectives. The working vocabulary: the identity provider (IdP) — Entra ID in most scenarios — authenticates the user and issues a signed assertion; the service provider (SP) — the app — validates the signature and admits the user. Claims inside the assertion (UPN, email, groups) map the user to an app-side account, and a shared signing certificate underwrites the whole trust — when it expires, SSO stops for everyone at once.

AspectSAML 2.0 / WS-FedOAuth 2.0 + OIDC
FormatXML assertionsJSON web tokens (JWT)
Primary jobWeb single sign-on (federation)API authorization + sign-in
Typical use on examGallery SaaS SSO, external IdP federationMicrosoft Graph, app registrations, consent
Mobile/API fitPoorNative
Trust anchored byExchanged signing certificatesPublished signing keys (OIDC metadata)

Direction matters and stems will flip it on you: when your workforce signs in to Salesforce, Entra is the IdP and Salesforce the SP; when a partner's users federate into your tenant as guests, their IdP authenticates and your tenant plays the relying side of the trust.

⚠️ Exam Trap: SAML signing certificates expire (Entra defaults to three years). "Users suddenly can't SSO into one specific SaaS app, but can access everything else" is the signature symptom — renew/rotate the certificate on both sides, don't reset passwords.

Reflection Question: Why does an expired SAML signing certificate break sign-in to that one app while OAuth-based apps in the same tenant keep working?

See how it connects
Alvin Varughese
Written byAlvin Varughese
Founder18 professional certifications