I have the following setup: all CM users are Azure AD users, all CM groups have Azure as identity provider and are mapped to appropriate Azure AD groups. No users is explicitly added to CM groups. Everything works fine when using the CM.

I have following Core service script that needs to impersonates various users to perform some actions:


Unfortunately get returns 0 items.

I have added Azure AD user explicitly to the group in the CM (the same one he already has access to through Azure AD) and the script now works fine (50 items are returned and can be processed further).

It seems that when impersonating a user that has membership set through external identity provider (like Azure AD) the core service doesn't properly identify access privileges.

How can I fix this?

  • Please clarify? Azure AD integration for hostname of the system registered to Azure AD. or Tridion Sites integrated with Azure SAML?
    – Velmurugan
    May 13, 2020 at 13:15
  • Tridion Sites integrated with Azure SAML
    – Valenton
    May 13, 2020 at 13:22

1 Answer 1


If the User you are impersonating only has implicit Group memberships (through external Group mappings), then impersonating the user by name only will indeed not work; you don’t tell the system which external groups the user is member of, after all.

If you can obtain the external Group memberships (claims) yourself, you can use the ImpersonateWithClaims method to provide all the relevant claims, so the system can do Group mapping.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.