SAML authentication to O365 for a subset of users - Is this possible?

%3CLINGO-SUB%20id%3D%22lingo-sub-2055316%22%20slang%3D%22en-US%22%3ESAML%20authentication%20to%20O365%20for%20a%20subset%20of%20users%20-%20Is%20this%20possible%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2055316%22%20slang%3D%22en-US%22%3E%3CP%3EI'm%20looking%20to%20trial%20SAML%20authentication%20using%20a%20third%20party%20IDP%20and%20I'm%20checking%20to%20see%20if%20it%20is%20possible%20to%20turn%20this%20on%20for%20a%20subset%20of%20users%20for%20testing.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20other%20words%2C%20I'm%20looking%20to%20place%20a%20subset%20of%20users%20in%20my%20organisation%20into%20a%20SAMLTest%20group.%26nbsp%3B%20Then%3A%3C%2FP%3E%3CUL%3E%3CLI%3Eusers%20in%20the%20test%20group%20now%20authenticate%20to%20O365%20via%20SAML%3C%2FLI%3E%3CLI%3Eusers%20not%20in%20the%20test%20group%20continue%20to%20authenticate%20via%20username%2Fpassword%3C%2FLI%3E%3C%2FUL%3E%3CP%3EIs%20this%20possible%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2055316%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2055794%22%20slang%3D%22en-US%22%3ERe%3A%20SAML%20authentication%20to%20O365%20for%20a%20subset%20of%20users%20-%20Is%20this%20possible%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2055794%22%20slang%3D%22en-US%22%3E%3CBR%20%2F%3EIn%20O365%2C%20its%20the%20domain%20you%20set%20as%20federated%20in%20order%20to%20route%20its%20authentication%20to%20the%20IDP%2C%20which%20means%20all%20users%20matching%20that%20UPN%20will%20get%20redirected%20to%20the%20IDP%20for%20authentication-%20not%20a%20per%20user%20setting.%3CBR%20%2F%3EHowever%2C%20you%20can%20add%2Fverify%20a%20new%20domain%20in%20O365%2C%20map%20the%20POC%2FSAMLtest%20group%20users%20with%20the%20new%20UPN%2C%20and%20federate%20this%20new%20domain%20with%20the%20IDP-%20that%20way%20their%20authentication%20will%20be%20handled%20thru%20SAML%2C%20while%20all%20other%20users%20will%20authenticate%20directly%20with%20O365%2FAzure%3C%2FLINGO-BODY%3E
New Contributor

I'm looking to trial SAML authentication using a third party IDP and I'm checking to see if it is possible to turn this on for a subset of users for testing.

 

In other words, I'm looking to place a subset of users in my organisation into a SAMLTest group.  Then:

  • users in the test group now authenticate to O365 via SAML
  • users not in the test group continue to authenticate via username/password

Is this possible?

 

3 Replies

In O365, its the domain you set as federated in order to route its authentication to the IDP, which means all users matching that UPN will get redirected to the IDP for authentication- not a per user setting.
However, you can add/verify a new domain in O365, map the POC/SAMLtest group users with the new UPN, and federate this new domain with the IDP- that way their authentication will be handled thru SAML, while all other users will authenticate directly with O365/Azure

@boneyfrancis Thanks for your response.  Yes, I had indeed noticed that it seemed impossible to separate a group of users being they share the same domain.

 

Would you happen to know if there's a demo of what you describe in your answer?  Also, would a user with a remapped UPN continue to communicate via the same email address of the un-federated domain?  I'm trying to make this as transparent as possible to the end user.

 

@ak2766 

 

I'm sure someone would have tried this, but I haven't personally seen any demo/articles on the same. The steps involved would be:

1. Add new MSOL domain in O365 using New-MsolFederatedDomain cmdlet

2. Run Set-MsolDomainFederationSettings to modify the parameters- at a minimum, you'll need ActiveLogOnUri, IssuerUri, LogOffUri, MetadataExchangeUri, PassiveLogOnUri and SigningCertificate parameters from your IDP provider

3. If your user accounts are created directly on O365, modify your UPN to match the newly added domain thru the admin portal or using Set-MsolUserPrincipalName. If your user accounts are managed from on-premise AD and synchronized to O365, you'll need to add a domain suffix in local AD matching the new UPN and then modify your UPN to match the newly added UPN suffix.

4. Now whenever you login to your O365 account, enter your new UPN as Username, and you'll get re-directed to your IDP for authentication. Once the initial tests are successful, you can repeat step-3 for more users as part of POC