Windows Server 2022 — ADFS SAML token claims missing after attribute store change — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

ADFS SAML token claims missing after attribute store change on Windows Server 2022 disrupts operations and prevents the affected service from meeting its SLA until remediated.

Environment & Reproduction

The issue reproduces on Windows Server 2022 hosts where the identity subsystem is in use, typically following configuration drift or recent updates.

Get-AdfsClaimsProviderTrust
Get-WinEvent -LogName 'AD FS/Admin' -MaxEvents 30

Root Cause Analysis

The defect stems from misaligned saml adfs settings, missing prerequisites, or a corrupted state that blocks normal operation.

Quick Triage

Confirm the service is running and capture current configuration state before applying any change.

Get-AdfsRelyingPartyTrust -Name 'App1' | Format-List
Get-AdfsAttributeStore

Step-by-Step Diagnosis

Walk the identity stack from configuration to runtime, collecting logs and counters that point at the failing component.

Get-WinEvent -LogName 'AD FS Tracing/Debug' -MaxEvents 50
Get-AdfsRelyingPartyTrust -Name 'App1' | Select IssuanceTransformRules

Solution — Primary Fix

Apply the corrected configuration and restart dependent services so the saml adfs component re-initialises cleanly.

$rules = '@RuleTemplate = "LdapClaims" @RuleName = "User Email" c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"] => issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"), query = ";mail;{0}", param = c.Value);'
Set-AdfsRelyingPartyTrust -TargetName 'App1' -IssuanceTransformRules $rules
Restart-Service ADFSSrv

Solution — Alternative Approaches

Where the primary fix is blocked by policy or downtime windows, use the alternative configuration path or staged rollout below.

Set-AdfsRelyingPartyTrust -TargetName 'App1' -IssuanceTransformRulesFile C:Rulesapp1.txt
Add-AdfsAttributeStore -Name 'CustomStore' -StoreType 'Microsoft.IdentityServer.ClaimsPolicy.Engine.AttributeStore.ActiveDirectory.ActiveDirectoryAttributeStore'

Verification & Acceptance Criteria

Confirm the service reports healthy state and end-to-end functionality succeeds against a representative workload.

Get-AdfsRelyingPartyTrust -Name 'App1' | Select IssuanceTransformRules
Get-WinEvent -LogName 'AD FS/Admin' | Where Id -eq 364

Rollback Plan

If the fix introduces regressions, revert configuration to the pre-change baseline and restart the service to restore prior behaviour.

Set-AdfsRelyingPartyTrust -TargetName 'App1' -IssuanceTransformRulesFile C:Backupapp1-rules.txt
Restart-Service ADFSSrv

Prevention & Hardening

Bake the validated saml adfs configuration into baseline GPOs or DSC and add a monitoring check for early detection.

Export-AdfsRelyingPartyTrust -Name 'App1' -FilePath C:Backupapp1.xml
Set-AdfsProperties -EnableLog $true

Related Errors & Cross-Refs

Related: other identity failures, dependent service errors, and downstream client-side symptoms.

Related tutorial: View the step-by-step tutorial for Windows Server 2022.

View all Windows Server 2022 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn documentation for Windows Server 2022 and the relevant component, plus internal runbooks.