How to configure Azure AD domain federation configuration other than via Azure AD Powershell

%3CLINGO-SUB%20id%3D%22lingo-sub-216789%22%20slang%3D%22en-US%22%3EHow%20to%20configure%20Azure%20AD%20domain%20federation%20configuration%20other%20than%20via%20Azure%20AD%20Powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-216789%22%20slang%3D%22en-US%22%3E%3CP%3EAs%20I%20am%20trying%20setup%20User%20sign-in%20for%20Office365%20with%20a%203rd%20party%20Identity%20Provider%2C%20I%20came%20across%20multiple%20resources%20on%20how%20to%20configure%20Azure%20AD%20via%20Windows%20PowerShell%20like%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fmodule%2Fmsonline%2F%3Fview%3Dazureadps-1.0%23msonline%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ethis%20reference.%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3Bex%3A%26nbsp%3B%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fmodule%2Fmsonline%2Fset-msoldomainfederationsettings%3Fview%3Dazureadps-1.0%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3ESet-MsolDomainFederationSettings%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20curios%20whether%20there%20are%20other%20means%20Azure%20AD%20web%20interface%20or%20a%20REST%20API%20to%20do%20the%20same%3FAppreciate%20any%20reference%20on%20this.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-216789%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EIdentity%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-217603%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20configure%20Azure%20AD%20domain%20federation%20configuration%20other%20than%20via%20Azure%20AD%20Powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-217603%22%20slang%3D%22en-US%22%3E%3CP%3EThank%20you%20very%20much%20for%20verifying%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F5953%22%20target%3D%22_blank%22%3E%40Nestori%20Syynimaa%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-216970%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20configure%20Azure%20AD%20domain%20federation%20configuration%20other%20than%20via%20Azure%20AD%20Powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-216970%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Ayesha%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20double-checked%20both%20Azure%20AD%20Graph%20API%20and%20Microsoft%20Graph%20API%20(newer%20one)%20but%20creating%2Fediting%20federated%20domains%20is%20not%20currently%20supported.%20So%20I%20guess%20you%20need%20to%20borrow%20someone's%20Windows%20machine%20to%20do%20this..%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-216965%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20configure%20Azure%20AD%20domain%20federation%20configuration%20other%20than%20via%20Azure%20AD%20Powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-216965%22%20slang%3D%22en-US%22%3E%3CBLOCKQUOTE%3E%3CHR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F5953%22%20target%3D%22_blank%22%3E%40Nestori%20Syynimaa%3C%2FA%3E%26nbsp%3Bwrote%3A%3CBR%20%2F%3E%3CP%3EHi%20Ayesha%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EUnfortunately%20there%20is%20no%20web%20interface%20to%20do%20this%2C%20but%20I%20think%20you%20could%20use%20Graph%20API.%20However%2C%20it%20is%20easiest%20to%20setup%20using%20PowerShell.%20Below%20is%20a%20script%20to%20start%20with.%20It%20is%20using%20MSOnline%20module%20(see%20%3CA%20href%3D%22http%3A%2F%2Fo365blog.com%2Fpowershell%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Fo365blog.com%2Fpowershell%3C%2FA%3E).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EActive%20and%20Passive%20login%20urls%20are%20used%20by%20active%20clients%20(i.e.%20Skype%20for%20Business)%20and%20web%20clients.%20Issuer%20and%20signin%20cert%20must%20match%20your%20IdP's%20settings.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3E%24Domain%3D%22yourdomain.com%22%3CBR%20%2F%3E%24LogOffUrl%20%3D%20%22https%3A%2F%2Fyourprovider%2Flogoff%2F%22%3CBR%20%2F%3E%24ActiveLoginUrl%20%3D%20%22https%3A%2F%2Fyourprovider%2Flogin%2F%22%3CBR%20%2F%3E%24PassiveLoginUrl%20%3D%20%22https%3A%2F%2Fyourprovider%2Flogin%2F%22%3CBR%20%2F%3E%24SigningCert%20%3D%20%22yourpublickey_in_Base64%22%3CBR%20%2F%3E%24Issuer%20%3D%20%22http%3A%2F%2Fyourprovider%2Fsomething%22%3CBR%20%2F%3E%24Protocol%20%3D%20%22SAMLP%22%3CBR%20%2F%3ESet-MsolDomainAuthentication%20-DomainName%20%24Domain%20-Authentication%20Federated%20-IssuerUri%20%24Issuer%20-LogOffUri%20%24LogOffUrl%20-PassiveLogOnUri%20%24PassiveLogInUrl%20-ActiveLogOnUri%20%24ActiveLogInUrl%20-SigningCertificate%20%24SigningCert%20-PreferredAuthenticationProtocol%20%24Protocol%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CHR%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CP%3EThank%20you%20very%20much%20for%20the%20valuable%20information%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F5953%22%20target%3D%22_blank%22%3E%40Nestori%20Syynimaa%3C%2FA%3E.%3C%2FP%3E%3CP%3EAs%20I%20am%20working%20on%20a%20non%20Windows%20OS%2C%20I%20am%20interested%20in%20a%20way%20other%20than%20a%20Powershell.%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20referred%20the%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fmsdn.microsoft.com%2FLibrary%2FAzure%2FAd%2FGraph%2Fapi%2Fapi-catalog%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3EAzure%20AD%20Graph%20API%20reference%3C%2FA%3E%26nbsp%3Band%20couldn't%20find%20any%20API%26nbsp%3Bresource%26nbsp%3Bffor%20modifying%26nbsp%3Bfederation%20configuration.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20reference%20on%20how%20to%20use%20some%20API%26nbsp%3Bis%20highly%20appreciated.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-216827%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20configure%20Azure%20AD%20domain%20federation%20configuration%20other%20than%20via%20Azure%20AD%20Powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-216827%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Ayesha%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EUnfortunately%20there%20is%20no%20web%20interface%20to%20do%20this%2C%20but%20I%20think%20you%20could%20use%20Graph%20API.%20However%2C%20it%20is%20easiest%20to%20setup%20using%20PowerShell.%20Below%20is%20a%20script%20to%20start%20with.%20It%20is%20using%20MSOnline%20module%20(see%20%3CA%20href%3D%22http%3A%2F%2Fo365blog.com%2Fpowershell%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Fo365blog.com%2Fpowershell%3C%2FA%3E).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EActive%20and%20Passive%20login%20urls%20are%20used%20by%20active%20clients%20(i.e.%20Skype%20for%20Business)%20and%20web%20clients.%20Issuer%20and%20signin%20cert%20must%20match%20your%20IdP's%20settings.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3E%24Domain%3D%22yourdomain.com%22%3CBR%20%2F%3E%24LogOffUrl%20%3D%20%22https%3A%2F%2Fyourprovider%2Flogoff%2F%22%3CBR%20%2F%3E%24ActiveLoginUrl%20%3D%20%22https%3A%2F%2Fyourprovider%2Flogin%2F%22%3CBR%20%2F%3E%24PassiveLoginUrl%20%3D%20%22https%3A%2F%2Fyourprovider%2Flogin%2F%22%3CBR%20%2F%3E%24SigningCert%20%3D%20%22yourpublickey_in_Base64%22%3CBR%20%2F%3E%24Issuer%20%3D%20%22http%3A%2F%2Fyourprovider%2Fsomething%22%3CBR%20%2F%3E%24Protocol%20%3D%20%22SAMLP%22%3CBR%20%2F%3ESet-MsolDomainAuthentication%20-DomainName%20%24Domain%20-Authentication%20Federated%20-IssuerUri%20%24Issuer%20-LogOffUri%20%24LogOffUrl%20-PassiveLogOnUri%20%24PassiveLogInUrl%20-ActiveLogOnUri%20%24ActiveLogInUrl%20-SigningCertificate%20%24SigningCert%20-PreferredAuthenticationProtocol%20%24Protocol%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

As I am trying setup User sign-in for Office365 with a 3rd party Identity Provider, I came across multiple resources on how to configure Azure AD via Windows PowerShell like this reference.

         ex:  Set-MsolDomainFederationSettings

 

I am curios whether there are other means Azure AD web interface or a REST API to do the same?Appreciate any reference on this.

4 Replies
Highlighted

Hi Ayesha,

 

Unfortunately there is no web interface to do this, but I think you could use Graph API. However, it is easiest to setup using PowerShell. Below is a script to start with. It is using MSOnline module (see http://o365blog.com/powershell).

 

Active and Passive login urls are used by active clients (i.e. Skype for Business) and web clients. Issuer and signin cert must match your IdP's settings.

 

$Domain="yourdomain.com"
$LogOffUrl = "https://yourprovider/logoff/"
$ActiveLoginUrl = "https://yourprovider/login/"
$PassiveLoginUrl = "https://yourprovider/login/"
$SigningCert = "yourpublickey_in_Base64"
$Issuer = "http://yourprovider/something"
$Protocol = "SAMLP"
Set-MsolDomainAuthentication -DomainName $Domain -Authentication Federated -IssuerUri $Issuer -LogOffUri $LogOffUrl -PassiveLogOnUri $PassiveLogInUrl -ActiveLogOnUri $ActiveLogInUrl -SigningCertificate $SigningCert -PreferredAuthenticationProtocol $Protocol

 

Highlighted

@Nestori Syynimaa wrote:

Hi Ayesha,

 

Unfortunately there is no web interface to do this, but I think you could use Graph API. However, it is easiest to setup using PowerShell. Below is a script to start with. It is using MSOnline module (see http://o365blog.com/powershell).

 

Active and Passive login urls are used by active clients (i.e. Skype for Business) and web clients. Issuer and signin cert must match your IdP's settings.

 

$Domain="yourdomain.com"
$LogOffUrl = "https://yourprovider/logoff/"
$ActiveLoginUrl = "https://yourprovider/login/"
$PassiveLoginUrl = "https://yourprovider/login/"
$SigningCert = "yourpublickey_in_Base64"
$Issuer = "http://yourprovider/something"
$Protocol = "SAMLP"
Set-MsolDomainAuthentication -DomainName $Domain -Authentication Federated -IssuerUri $Issuer -LogOffUri $LogOffUrl -PassiveLogOnUri $PassiveLogInUrl -ActiveLogOnUri $ActiveLogInUrl -SigningCertificate $SigningCert -PreferredAuthenticationProtocol $Protocol

 


Thank you very much for the valuable information @Nestori Syynimaa.

As I am working on a non Windows OS, I am interested in a way other than a Powershell. 

I have referred the Azure AD Graph API reference and couldn't find any API resource ffor modifying federation configuration. 

 

Any reference on how to use some API is highly appreciated.

Highlighted

Hi Ayesha,

 

I double-checked both Azure AD Graph API and Microsoft Graph API (newer one) but creating/editing federated domains is not currently supported. So I guess you need to borrow someone's Windows machine to do this..

Highlighted