Web apps authenticate against a SAML IdP. The SAML IdP is among the very small list of things that is allowed to talk directly to Active Directory. Access to s

Web apps authenticate against a SAML IdP. The SAML IdP is among the very small list of things that is allowed to talk directly to Active Directory. Access to specific applications is usually controlled by group membership.