Azure to APM to StoreFront

Ordinarily you wouldn't pass login credentials (like a password) directly to an SP. Instead, you create a chain of trust so that each SP can send a SAML AuthN to the prior link in the chain, then the prior link sends the next link a SAML Assertion. This avoids the security problems with passing around credentials.

Azure (IdP) -> APM (combined SP and IdP) -> Storefront w/FAS (SP)

 This discussion covers federated SAML in this kind of scenario:

Citrix Federated Authentication Service Integration with APM | DevCentral