Error: Unable to uniquely identify the user using provided claims (4249896)

After configuring Azure Federated Authentication for the Active Roles Web Interface, the following error message is shown after authenticating using Azure AD credentials:

Unable to uniquely identify the user using provided claims. Please contact your Active Roles Administrator

or

Cause 1

• The user logging in to the Active Roles Web Interface is unable to be uniquely mapped to an object in either Azure or Active Directory using the provided claims type

Cause 2

• The Active Roles Application Pool ARWebAppPool is not configured with the correct identity

Cause 3

• Group Policy Object Deny access to the user log on Active Roles from the network

Resolution 1

• Ensure the attribute used by the claim type is unique in both Azure AD and Active Directory
  • ​For example, if the claim type is configured to use UPN, ensure the user accessing the Web Interface has a UPN that is unique in both Azure AD and Active Directory

Resolution 2

• On the Active Roles Web host, Ensure the ARWebAppPool Application Pool in IIS is configured to use the Identity LocalSystem

• Ensure there is no GPO configured allowing only specific users to log in to the Active Roles server.