Create a new application group in ADFS with the following configuration :

Standalone application > Server application

Set a name that will define your application

Hit next and copy the client identifier to a notepad, you will need it later.

The redirect URI is the server local URI you will use to test your application using Visual Studio.

You can use https://localhost:44320 or any local port for the tests.

The redirect uri is where the client will be send to after the account authorization is successful.

Hit next and select a shared secret, copy the information.

Click add application > WEB API

Set a name and create an uri identifier.

The URI Identifier or relying party identifiers identify either a network addresses or a URN ( configuration objects).

In this case we choose to use : https://domain.com/identifier/myapp which is a URL.

This identifier is used to identify the relying party to the Federation service. It is used when issuing claims to the relying party.

For the Client permissions, we specify:  AllatClaims, OpenID and User_impersonalisation.

The issuance transform rules are set to validate the UPN as a claim and also security groups part of the Active Directory.

Those are claims that will be used when the user try to authenticate against the relying party identifiers.

The UPN is excepted to be received in a Active Directory format (User-Principal-Name) and issue a claim to the API with a UPN format.

The rest of the SG-groups rules are to validate if the user if part of a certain group.

Within Active Directory, the user will be validate if its part of  mydomain\sg-ActiveDirectory group and will issue a claim to the API with the sg-ActiveDirectory value.

#Allow seamless sign in for ADFS2016
Set-AdfsProperties -WIASupportedUserAgents ((Get-ADFSProperties | Select -ExpandProperty WIASupportedUserAgents) + “Chrome” + “Mozilla/5.0” + “Edge/12”)
https://itrambling.wordpress.com/2017/08/18/windows-server-2016-adfs-sso-with-chrome-firefox-and-other-user-agents/

Register the application in Azure

Select Azure Active Directory

Click App Registration

New App Registration

1. • • Application name = Myapp
     • Application type = Web API
     • Sign-on URL : Set https://domain.com/identifier/myapp for the time being. This might change
   • Once created click on Settings > Required Permissions
   • Add Microsoft Graph
     • Select Read Directory Data (Directory.Read.All)
     • Select Read all users’ full profiles (User.Read.All)
     • Click Grant permissions and return back

1. • Click keys, generate one and copy it
   • Provide the necessary information to the dev (Application ID, password set for the Key and the TenantID of the directory).

Reference : https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/development/enabling-openid-connect-with-ad-fs

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/overview/ad-fs-scenarios-for-developers