question

TristanMelendreras-2934 avatar image
0 Votes"
TristanMelendreras-2934 asked vipulsparsh-MSFT commented

G Suite as an Identity Provider for Azure SSO

Good day Microsoft Community

Background
We have about 60 Azure users who are currently Managed through Microsoft 365. We want to convert these users to Federated users in order to provide a SSO experience and ease of management. However, our Identity Provider and email are hosted through G Suite and migrating to O365 email is not an option.

Goal
Create Federation between these two providers so that end users can activate their Microsoft 365 business apps via SSO using their G Suite credentials.

We've found several articles on the web including this one, which almost fits our bill, except that we cannot Federate our O365 domain because we don't have an Active Directory Federation Services 2.0 server onsite. 95431-screen-shot-2021-05-06-at-70027-pm.png
Note: I've redacted our domain name on the PowerShell output for privacy purposes.

Has anyone attempted to use G Suite as an Identity Provider for Azure SSO before? Any experience or insight is highly appreciated.

Thank you for your time.


azure-ad-microsoft-account
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

vipulsparsh-MSFT avatar image
0 Votes"
vipulsparsh-MSFT answered vipulsparsh-MSFT commented

@TristanMelendreras-2934 Thanks for reaching out. From the same document that you mentioned, can you try following accordingly :

Run the following PowerShell command IF this is the first time you are setting up federation on this domain:

Set-MsolDomainAuthentication -DomainName $domainName -Authentication $Authentication -FederationBrandName $FederationBrandName -IssuerUri $IssuerUri -ActiveLogOnUri $ActiveLogOnUri -PassiveLogOnUri $PassiveLogOnUri -LogOffUri $LogOffUri -SigningCertificate $SigningCertificate -PreferredAuthenticationProtocol SAMLP

Run the following PowerShell command IF you already have federation on this domain, and now need to change it to Google :

Set-MsolDomainFederationSettings -DomainName $domainName -Authentication $Authentication -FederationBrandName $FederationBrandName -IssuerUri $IssuerUri -ActiveLogOnUri $ActiveLogOnUri -PassiveLogOnUri $PassiveLogOnUri -LogOffUri $LogOffUri -SigningCertificate $SigningCertificate -PreferredAuthenticationProtocol SAMLP

Values can be like this from your google Gsuite account. (Below values are taken from the link you shared)

$domainName = “domain.com
$Authentication = “Federated”
$FederationBrandName = “Google Cloud Identity”
$IssuerUri = “https://accounts.google.com/o/saml2?idpid=C03a9sjs9
$PassiveLogOnUri = “https://accounts.google.com/o/saml2/idp?idpid=C03a9sjs9
$ActiveLogOnUri = “https://accounts.google.com/o/saml2/idp?idpid=C03a9sjs9
$LogOffUri = “https://accounts.google.com/logout
$SigningCertificate = “MIIDdDCCAlygAwIBAgIGAXEQDuMqMA0GCSqGSIb3DQEBCwUAMHsxFDASBgNVBAoTC0dvb2dsZSBJbmMuMRYwFAYDVQQHEw1
Nb3VudGFpbiBWaWV3MQ8wDQYDVQQDwZHb29nbGUxGDAWBgNV
BAsTD0dvb2dsZSBGb3IgV29yazELMAkGA1UEBhMCVVMxEzARBgN
VBAgTCkNhbGlmb3JuaWEwHhcNMjAwMzI1MDQ1OTAxWhcNMjUw
MzI0MDQ1OTAxWjB7MRQwEgYDVQQKEwtHb29nbGUgSW5jLjEWMB
QGA1UEBxMNTW91bnRhaW4gVmlldzEPMA0GA1UEAxMGR29vZ2xlM
RgwFgYDVQQLEw9Hb29nbGUgRm9yIFdvcmsxCzAJBgNVBAYTAlVTM
RMwEQYDVQQIEwpDYWxpZm9ybmlhMIIBIjANBgkqhkiG9w0BAQEFAA
OCAQ8AMIIBCgKCAQEA6GfDWaCspEWgMKE8aTpUq3W95p9JulrT4UE
ROj6s3/RJDpyCeZQYOPOcFiJqEIPwiEK5QFkQFHOZUEgjqhHAcyDUf1D”


IMP : Convert-MsolDomainToFederated commands expects the ADFS to be involved and thus looks for that. You do not need to do that.


If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community.

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thank you for your response @vipulsparsh-MSFT
I am scheduled to be onsite on Thursday and will follow your recommendation.

0 Votes 0 ·
vipulsparsh-MSFT avatar image vipulsparsh-MSFT TristanMelendreras-2934 ·

@TristanMelendreras-2934 Do let me how it goes. All the best

0 Votes 0 ·