To support SAML token exchanges, Azure AD functions as the "identity provider," exchanging a public key and then getting a private key in response from a "service provider." The service provider ...