How To: Federate a Microsoft Entra ID Domain with SecureAuth IdP Using Microsoft Graph – SecureAuth Support

Version Affected: All

INTERNAL KNOWLEDGE BASE ARTICLE

Overview

This article describes how federate a Microsoft Entra ID Domain with SecureAuth IdP Using Microsoft Graph PowerShell module as the MSOL module is depricated by Microsoft and cannot be used to configure federation.

# Install Microsoft Graph module if not already installed 
Install-Module Microsoft.Graph -Scope CurrentUser 

# Connect with required scope 
Connect-MgGraph -Scopes "Domain.ReadWrite.All" 'Directory.AccessAsUser.All'

# Set variables
$url = "https://example.com/Secureauth##/"
$ura = "https://example.com/Secureauth##/webservice/wstrust.svc/2005/usernamemixed"
$metadata = "https://example.com/Secureauth##/webservice/wstrust.svc/mex"
$uri = "https://example.com/Secureauth##"
$logouturl = "https://example.com/Secureauth##/wsfedsignout.aspx"
$cert = "cert-value-without-line-breaks-or-whitespaces"

# Command to Federate the domain
New-MgDomainFederationConfiguration -DomainId 'Example.com' -DisplayName "Example Corp" -PassiveSignInUri $url -ActiveSignInUri $ura -MetadataExchangeUri $metadata -IssuerUri $uri -SignOutUri $logouturl -SigningCertificate $cert -PreferredAuthenticationProtocol "wsFed" -FederatedIdpMfaBehavior "acceptIfMfaDoneByFederatedIdp"

# Verify the change 
Get-MgDomain -DomainId "example.com"
Get-MgDomainFederationConfiguration -DomainId "example.com"

How to rollback?

To rollback the change, the domain needs to be changed back to Managed by using below cmd:

Update-MgDomain -DomainId "example.com" -AuthenticationType "Managed"

Special Considerations -

Once you switch a domain from Managed to Federated, wait for at least an hour for the change to replicate before you rollback the changes.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.

Related to