I understand that Azure ACS acted as a STS that had the ability to redirect users to a given STS (OpenID, LiveID, Facebook) or authenticate using a local user/password account.
In a passive situation ACS would use redirects and either respond with a SAML token, and could be a User STS holding user accounts, or a resource STS protecting websites but leaving the user authentication for another host.
Now that ACS is being depreciated in favor of Azure Active Directory, I'd like to know what are the fundamental differences in how Azure AD works on the wire.
Question
What are some sample request-response patterns that would be seen when using Azure Active Directory in an active or passive approach?
Since Azure allows for on-premise AD integration, how is home realm discovery accomplished with an arbitrary UPN