More and more customers are integrating their SharePoint on-premises environment with Azure Active Directory. The solution AzureCP is used to accomplish this quite easily. The solution installs a custom claims provider and you can configure some using the settings interface that is available in Central Administration. There is a good installation article how to set it all up.
When you enable the Trusted Identity Provider on the web application for Azure AD together with Windows Authentication (which is required for Search Crawling account on the Default zone), you will see the following:
Notice that the sign in page URL is also set to a custom one. This will kick off the Microsoft Sign-In page for Azure AD:
Above configuration will have its effect on the PeoplePicker. Your account may appear multiple times. Especially when you have Azure AD Connect in place.
One appearance is from local Windows Active Directory and the other is from Azure Active Directory. This is very inconvenient for your end users. They can easily choose the wrong one.
It is possible to hide a claims provider. Not disabling it, but just making it invisible from the People Picker. This can be done with PowerShell:
$cpm = Get-SPClaimsProviderManager
$cp = Get-SPClaimsProvider -Identity "AD"
$cp.IsVisible = $false
$cpm.Update()
This makes the Windows Authentication provider (local Active Directory) invisible for your farm and the user accounts from local AD will not be shown in the People Picker.
Good luck!
This article was originally posted at: https://blog.octavie.nl/index.php/2019/07/09/managing-the-peoplepicker-when-custom-claims-providers-exist
