# SAML Transformation Fallback Workaround (Microsoft Entra ID)

<table class="MsoNormalTable" id="bkmrk-field-details-docume" style="width: 69.2857%; height: 178.781px;" title=""><tbody><tr style="height: 29.7969px;"><td style="width: 19.6199%; height: 29.7969px;">**Field**

</td><td style="width: 80.1653%; height: 29.7969px;">**Details**

</td></tr><tr style="height: 29.7969px;"><td style="width: 19.6199%; height: 29.7969px;">Document Type

</td><td style="width: 80.1653%; height: 29.7969px;">How-To Guide - SSO SAML Transformation Runbook

</td></tr><tr style="height: 29.7969px;"><td style="width: 19.6199%; height: 29.7969px;">Applies To

</td><td style="width: 80.1653%; height: 29.7969px;">Microsoft Entra ID, 3rd-Party WebApps &amp; Single-name user accounts

</td></tr><tr style="height: 29.7969px;"><td style="width: 19.6199%; height: 29.7969px;">Audience

</td><td style="width: 80.1653%; height: 29.7969px;">2nd Line / Entra ID Admins / IT Engineer

</td></tr><tr style="height: 29.7969px;"><td style="width: 19.6199%; height: 29.7969px;">Author

</td><td style="width: 80.1653%; height: 29.7969px;">AK. Udofeh

</td></tr><tr style="height: 29.7969px;"><td style="width: 19.6199%; height: 29.7969px;">Last Updated

</td><td style="width: 80.1653%; height: 29.7969px;">Jan 2026

</td></tr></tbody></table>

##### **Overview**

This document describes a targeted workaround implemented within Microsoft Entra ID to address a SAML single sign-on (SSO) integration limitation with 3rd-Party or InHouse LOB WebApp, where the service provider requires the givenName (first name) attribute to be present during authentication.

The workaround enables successful authentication for users who have a single name recorded in Entra ID (i.e. no givenName or surname attribute populated), without modifying directory data.

##### **Background**

During an investigation of a user login issue raised by a 3rd-Party Service Provider support team, it was identified that:

- The WebApp requires all user accounts to have both givenName and surName attributes to be populated in Entra ID.
- Microsoft Entra ID successfully completes SAML authentication even when givenName is empty.
- The WebApp enforces givenName as a mandatory SAML attribute and rejects authentication if it is missing.

This behaviour is Service Provider side and outside of Entra ID control. However, a controlled, application-scoped workaround is possible using SAML claim transformations.

##### **Design Principles**

The workaround was designed with the following principles in mind:

- **Application-scoped only** – no tenant-wide or directory-wide impact
- **Non-destructive** – no changes to user objects or identity source data
- **Least privilege / minimal impact** – only activates when givenName is empty
- **Reversible** – easy to remove if Service Provider configuration changes

##### **Technical Summary**

The SAML givenName claim for the WebApp Enterprise Application is configured using a conditional transformation:

- If user.givenName is populated &gt; send user.givenName
- If user.givenName is empty &gt; fall back to user.displayName

This ensures that the WebApp always receives a non-null givenName value, allowing authentication to complete successfully.

No other SAML claims are affected.

##### **Implementation Details**

Microsoft Entra ID &gt; Enterprise Applications &gt; WebApp &gt; Single sign-on &gt;Attributes &amp; Claims

##### **Claim:**

- Name: givenname
- Namespace: <span data-annotation-inline-node="true" data-annotation-mark="true" data-card-url="http://schemas.xmlsoap.org/ws/2005/05/identity/claims" data-inline-card="true" data-renderer-start-pos="1990"><span class="loader-wrapper"><span class="hover-card-trigger-wrapper" data-testid="hover-card-trigger-wrapper">[<span class="_19itglyw _vchhusvi _r06hglyw _o5721jtm _1nmz9jpi _16d9qvcn _ca0qv77o _u5f31b66 _n3tdv77o _19bv1b66" data-testid="inline-card-icon-and-title"><span class="_19itglyw _vchhusvi _r06hglyw">Default</span></span>](http://schemas.xmlsoap.org/ws/2005/05/identity/claims)</span></span></span>

##### **Transformation Logic:**

1. IfNotEmpty(user.surname) &gt; output user.surname
2. IfEmpty(previous output) &gt; output user.givenname

[![f173a4ac-8b74-4c80-87e1-36e746334983.png](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/scaled-1680-/f173a4ac-8b74-4c80-87e1-36e746334983.png)](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/f173a4ac-8b74-4c80-87e1-36e746334983.png)

This transformation is evaluated at authentication time and does not write back to Entra ID.

##### **Impact Assessment**

##### **Who is affected:**

- Only users authenticating to WebApp via SAML
- Only users whose givenName attribute is empty

##### **What changes:**

- WebApp receives a synthetic givenName value for single-name users

##### **What does NOT change:**

- Entra ID user attributes
- Other enterprise applications
- Authentication behaviour for users with a populated givenName

##### **Risks and Considerations**

- The givenName value provided to the WebApp may not represent a true first name.
- If the WebApp stores or reuses the attribute internally, the fallback value may persist within their system.
- This workaround compensates for a Service Provider SAML attribute mandatory requirement and should be reviewed if Service Provider updates its SAML requirements.

This implementation should not be used as a general pattern unless explicitly required.