title: How to release Active Directory confiential attributes via ADFS claim
body: <p>I have marked the &quot;Employee-Number&quot; AD attribute as &quot;confidential&quot; by setting it's searchflags to 128 in ADSI Edit (<a href="https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/mark-attribute-as-confidential" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/mark-attribute-as-confidential</a>.</p>
  <p>I've verified that Domain Admins can read it and non-admins cannot.  I've also verified that the ADFS service account is a Domain Admin.</p>
  <p>However, if I try to release that attribute via a simple ADFS claim, it doesn't work. I've also verified that if I toggle the SearchFlags value back to 0, the claim is released as expected.</p>