SharePoint user profile sync setup with claims and PowerShell

When you throw claims authentication in the mix of AD users and SharePoint user profiles there is some things you should be aware of:

  • Use your Identity Provider to make the user profile sync connection to the domain
  • There’s no built in mapping between the user profile identifier and claim (or forms) users identity provider; missing this will give you more than one user profile per user!

Setting up the sync connection with Identity Provider

Set up with claims user and Identity Provider can be setup in the Central Admin or through this PowerShell cmdlet


But beware, it is only intended for SharePoint Online environments, now you are warned!

I found it working on “on premise” fine, but there is no warranties!

Specific for the Claims scenario I will just point out the following parameters.
All the parameters are explained on this TechNet article:








Specifies the Claims Provider ID or Name for an authentication type while a Web App is configured.




Specifies the Authentication claim Provider that will be used to encode the User Profile accounts names. For example, Windows/Forms etc. This means if a user logs in using the given Authentication Type, then a profile can be found by looking up a claim encoded credentials.

The PowerShell could look something like this:

#provision connection with Claim Provider Add-SPProfileSyncConnection
-ProfileServiceApplication 888ds256-9ad9-53a9-f135-99eecd245670b `
-ConnectionClaimProviderIdValue "ClaimProviderName" `
-ConnectionClaimProviderTypeValue "Trusted" `
-ConnectionForestName ""-ConnectionDomain "Fabrikam" `
-ConnectionUserName "Testupa" `
-ConnectionPassword convertto-securestring "Password1" `
-ConnectionSynchronizationOU "OU=SharePoint Users,DC=fabrikam,DC=com"



  • Only in SharePoint 2010 Service Pack 1 !
  • The account running the PowerShell window must be added as an administrator for the UPA.
  • Remove-SPProfileSyncConnection does not delete sync connections!
  • … see below

Others explaining the use of this cmdlet


Mapping between AD user and Claim user

When setting up a SharePoint 2010 application with claims authentication, there’s no built in mapping between the AD user profile’s and claim (or forms) user. (see my former post User profile property mappings in SharePoint and Active Directory and the TechNet article

In claims-based Web applications, SharePoint Server uses the Claim User Identifier property (SPS-ClaimID) to match an authenticated user to the correct user profile. If the SPS-ClaimID is not mapped to the directory service attribute that you want to use as the user identifier, when a user is authenticated, he or she is not matched to the correct user profile and will not see the imported user profile data.

Worst case this will give you more than one user profile per user.

The mapping between the claim user and the AD user is done by setting the SPS-ClaimID (Claim User Identifier) to sAMAccountName (UserName)through the User Profile Service Application.

Claim User Identifier

This property mapping must be manually inserted if using Forms or Trusted Identity providers.

claim user props mapping

Or you can use PowerShell to set this mapping. The AddNewMapping cmdlet can do just that.

$synchConnection.PropertyMapping.AddNewMapping([Microsoft.Office.Server.UserProfiles.ProfileType]::User, $spsPropertyName, $userPropertyName)

Remember to do a full sync after setting this property mapping!


This CodePlex project contains a PowerShell script to help you automate the creation of SharePoint 2010 User Profile Synchronization connections, User Profile Properties and User Profile Property mappings.

Create/Manage SPS2010 User Profile Properties or Sync Connection from Powershell

Other use full links: