Use Microsoft Entra ID authentication for two domains

Hi ​@dongl73670315,

Yes, this can be supported in AEM Forms on JEE.

For your setup, the recommended approach is to configure two separate enterprise domains in AEM Forms, with each domain continuing to use its own LDAP/Active Directory server for directory lookup and synchronization.

Then, for authentication, configure SAML-based single sign-on with Microsoft Entra ID for each enterprise domain.

So the model would be:

• Enterprise Domain 1

  • LDAP/Directory Provider → Active Directory Server 1
  • Authentication Provider → SAML
  • Identity Provider → Microsoft Entra ID

• Enterprise Domain 2

  • LDAP/Directory Provider → Active Directory Server 2
  • Authentication Provider → SAML
  • Identity Provider → Microsoft Entra ID

This allows you to keep the existing separation of the two enterprise domains and their respective AD sources, while centralizing user authentication through Microsoft Entra ID.

If both SAML providers are configured and exposed, AEM Forms can also present the user with a selection page for the configured identity providers. If needed, this can be further customized with a discovery page to make the sign-in experience clearer for users.

At a high level, the implementation steps are:

1. Create or update each enterprise domain in AEM Forms.
2. Configure each domain’s directory provider to point to its respective AD server.
3. Add a SAML authentication provider for each domain.
4. Import the corresponding Microsoft Entra ID metadata into each SAML provider configuration.
5. Validate that the SAML claims / NameID map correctly to the user records in the corresponding AEM Forms domain.

If helpful, we can also provide a more detailed step-by-step checklist for the AEM Forms configuration and the corresponding Microsoft Entra ID enterprise application settings.

Thanks
Pranay