SAML 2.0 Authentication with Azure SSO?

Here are the settings I used.

In Azure

1. In Azure, use the "Add application" button and then select the "Non-gallery application" button.
2. In the Single Sign-on section, select "SAML-based Sign-on" for the Single Sign-on Mode
3. Check the "Show advanced URL settings" checkbox.
4. In the Identifier, Reply URL and Sign on URL fields enter https://<your WHD domain>/helpdesk/WebObjects/Helpdesk.woa
5. In the User Attributes section, choose "ExtractMailPrefix()" for User Identifier and "user.mail" for Mail.
6. Download the certificate (create if needed) and the Metadata XML files
7. Assign at least one user to the application for use in testing SSO logins.

In WHD

1. Under Settings -> General -> Authentication, Select SAML 2.0 from the Authentication Method drop-down
2. Upload the certificate you downloaded from Azure to the "Verification Certificate" field.
3. Open the XML file you downloaded and scroll to the very end of the file. Just before the end of the file you will find an URL, https://login.microsoftonline.com/<your identifier>/saml2. where "<your identifier>" will be your unique ID.
4. Copy this URL from the XML file and paste it into the "Sign-in page URL" field
5. Check the "Show Password Settings" checkbox.
6. In the "Logout URL" field, paste the following URL: https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0
7. Click Save and you should be done

Thanks for this information. Is it possible to use LDAP and SAML side-by-side to be allow users who are not in the connected AzureAD tenant to login using their company credentials?

I don't think so, if you are using AzureAD for your login, they have to be within this Tenant or Multiple trusted Tenants. You will need to use a third party SAML like Okta which can validate against multiple sources.

I don't think so, if you are using AzureAD for your login, they have to be within this Tenant or Multiple trusted Tenants. You will need to use a third party SAML like Okta which can validate against multiple sources.

Just what I had found out then. We would like to be able to do two-factor authentication for the techs, but a lot of normal users login using LDAP from different sources.

Always a minefield when you want to mix authentication methods for difference audiences. 

Yes. When I have spare time (duh!), I could test it with an Azure tenant and guest accounts in that tenant. Not a priority, the current setup works.