Entra ID does not seem to respect the SAML standard regarding the optional 'isPassive' parameter.

Question

Entra ID does not seem to respect the SAML standard regarding the optional 'isPassive' parameter.

George-0304 20

When a SAML AuthnRequest with the optional parameter is sent to `Entra ID (Azure Active Directory) without the user having an active session the request fails with a Bad Request error. The error is the following:

AADSTS50058: A silent sign-in request was sent but no user is signed in.

The expected behaviour is to return a Response with a <saml2p:Status> containing an error code like urn:oasis:names:tc:SAML:2.0:status:NoPassive.

This issue seems that it was not present in ADFS but it is still present in Entra ID despite numerous reports (e.g. https://learn.microsoft.com/en-us/answers/questions/1041674/configure-redirect-for-failed-silent-saml-login-in). Most of the answers refer to other authentication workflows supported by Entra ID but are simply irrelevant in the case of SAML.

The standard is quite clear on this point:

[Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0] (page: 49/86, line: 2047) IsPassive [Optional] A Boolean value. If "true", the identity provider and the user agent itself MUST NOT visibly take control of the user interface from the requester and interact with the presenter in a noticeable fashion. If a value is not provided, the default is "false".

Note that the capitalization is not mine. It is more than clear that a SAML IdP should not interrupt the request flow for an AuthnRequest containing isPassive="true". The Entra ID/Azure AD implementation only respects this if the user already has an active session within the respective tenant. If no session cookie is found, Entra ID halts the navigation and displays the AADSTS50058 error page.

While this error code is used across other protocols, its behavior in a SAML context appears to be non-compliant. In my experience with other IdPs, none hijack the browser to inform the user of a missing session. Instead, they redirect back to the Service Provider (SP) with a SAML <Response> indicating a failure to authenticate "passively". Although the standard does not mandate a specific <saml2p:Status> or <saml2p:StatusCode> (leading to some variability among implementations), it is clear that the flow must return to the SP.

Rukmini 43,995 Reputation points Microsoft External Staff Moderator

2026-06-08T23:17:16.14+00:00

Hello @George-0304

This behavior is currently expected in Microsoft Entra ID. When a SAML AuthnRequest contains IsPassive="true" and no active Entra ID session exists, Entra ID returns AADSTS50058 ("A silent sign-in request was sent but no user is signed in") instead of issuing a SAML <Response> with a NoPassive status.

There isn't yet a supported configuration or tenant-level setting to alter this behavior. Applications that integrate with Entra ID should recognize AADSTS50058 as a message that passive authentication is not possible and, if necessary, start an interactive sign-in process.

Please send feedback to Microsoft: Ideas · Community

Let me know if any further queries - feel free to reach out!
George-0304 20 Reputation points

2026-06-09T00:43:49.8066667+00:00

Thanks for your answer.

Still, this means that Entra ID is not compliant and there is no reference to it in the documentation and they who use it in their organizations (the clients) do not know this.

There isn't yet a supported configuration or tenant-level setting to alter this behavior. Applications that integrate with Entra ID should recognize AADSTS50058 as a message that passive authentication is not possible and, if necessary, start an interactive sign-in process.

Can you elaborate more on this. How should an application that is using SAML detect this if Entra ID intercepts the navigation flow. SAML does not assume a service that you send a request and you receive a response "user is not authenticated". If I am not wrong, SAML assumes the IdP will return a Response to the Assertion Consumer Service of the SP and not fail unless there is an internal server error of some sort.

Answer accepted by question author

0 additional answers

Your answer

Rukmini 43,995 Reputation points Microsoft External Staff Moderator

2026-06-08T23:17:16.14+00:00

Hello @George-0304

This behavior is currently expected in Microsoft Entra ID. When a SAML AuthnRequest contains IsPassive="true" and no active Entra ID session exists, Entra ID returns AADSTS50058 ("A silent sign-in request was sent but no user is signed in") instead of issuing a SAML <Response> with a NoPassive status.

There isn't yet a supported configuration or tenant-level setting to alter this behavior. Applications that integrate with Entra ID should recognize AADSTS50058 as a message that passive authentication is not possible and, if necessary, start an interactive sign-in process.

Please send feedback to Microsoft: Ideas · Community

Let me know if any further queries - feel free to reach out!
George-0304 20 Reputation points

2026-06-09T00:43:49.8066667+00:00

Thanks for your answer.

Still, this means that Entra ID is not compliant and there is no reference to it in the documentation and they who use it in their organizations (the clients) do not know this.

There isn't yet a supported configuration or tenant-level setting to alter this behavior. Applications that integrate with Entra ID should recognize AADSTS50058 as a message that passive authentication is not possible and, if necessary, start an interactive sign-in process.

Can you elaborate more on this. How should an application that is using SAML detect this if Entra ID intercepts the navigation flow. SAML does not assume a service that you send a request and you receive a response "user is not authenticated". If I am not wrong, SAML assumes the IdP will return a Response to the Assertion Consumer Service of the SP and not fail unless there is an internal server error of some sort.

Answer 1

Rukmini 43,995 Microsoft External Staff Moderator

Hello George-0304 You're right. When there is no active session, the SP does not receive a SAML Response with a NoPassive status in the current Entra ID implementation. Instead, Entra ID stops the SAML response from getting to the ACS endpoint by stopping the flow and displaying the AADSTS50058 error page. Because of this, a SAML SP cannot identify this circumstance using only conventional SAML protocol processing. There is currently no supported configuration to change this behavior, and it is a product limitation of the present Entra ID SAML implementation. If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know.

Rukmini 43,995 Reputation points Microsoft External Staff Moderator

2026-06-10T18:50:36.08+00:00

Hello @George-0304

If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know.