The problem.
A higher-education institution wants to replace its Shibboleth IdP with Microsoft Entra ID without breaking access to federated academic services.
What I built.
01
Analysis
- 6 months of authentication logs: services actually used and attributes released to each.
- Critical attributes to reproduce in Entra ID (eduPersonPrincipalName, eduPersonUniqueId, affiliations…) and NameID format.
02
Plan
- Pilot service prioritisation, progressive cut-over plan and proof-of-concept presentation.
The architecture.
Users
Shibboleth IdPRENATER / eduGAIN
Entra IDtarget
17 SAML services
Security & guardrails.
- Start from the logs, not from the assumed configuration.
The results.
- A migration grounded in real usage; lessons published as an article.
