HI I have just upgraded from SharePoint 2010 to 2013 using the Mount-SPContentDatabase PowerShell commandlet. I was able to migrate successfully and made the change from Classic Auth to Claims, and it retained the user permissions for the main site and sub sites. Our main goal now is to use ADFS as out trusted identity provider which I configured successfully, only to run into permissions not being retained.

My questions is why wouldnt SharePoint retain the permissions that were already set, the only difference is how you log on to the site? Is there a keep retain the set permissons when using a trusted Identity provider like ADFS?

I will post example i

Before I switch to ADFS Auth I am able to see the sub site links I have permissions

Permissions for links to sub sites after ADFS Auth

When you switch from Windows Auth (Classic or Claims) to SAML (ADFS), you must migrate the users as well.

You have two options:

Using Move-SPUser or using Convert-SPWebApplication using an input file:

https://support.microsoft.com/en-us/kb/3042604

Thanks Trevor for the quick link however when I tried this command to convert to trusted identity provider

Convert-SPWebApplication -Identity $wa -TO CLAIMSTRUSTEDDEFAULT -FROM CLAIMSWINDOWS -TrustedProvider $tp -sourceskiplist E:\users.csv -RetainPermissions -Force it errors out.

it doesn't seem to like the parameter CLAIMSTRUSTEDDEFAULT. Am I using the correct parameter for the TO attribute.

Hi Neil,

The parameters defined are not correct in your command, please use the command below and then check the results:

Convert-SPWebApplication -Identity "http://<webappurl>" -To Claims -From Legacy -RetainPermissions Force

More reference:

https://technet.microsoft.com/en-us/library/JJ219696.aspx

Thanks,

Victoria