Configuring Office 365 Federation for external users and native Office 365 auth for internal users

[Miguel Isidoro]

Hi,

I want external users to federate external users authentication in Office 365 with an external identity provider. The authentication provider is not implemented by us. The goal is to enable both internal and external users to access Office 365 resources, namely SharePoint Online.

Is it possible to have internal users authenticate using native Office 365 authentication (using URL https://login.microsoftonline.com/common/oauth2/v2.0/authorize, going against Azure AD directly) and have external users to be authenticated against na external identity provider?

According to https://docs.microsoft.com/en-us/azure/active-directory/external-identities/direct-federation, a domoin must be configured as being federated and thus a user must enter a email in the default Office 365 login page (https://login.microsoftonline.com/common/oauth2/v2.0/authorize) from the domain that is going to be federated so that the authentication can be done in the external identity provider page (user gets redirected if it enters na email from the federated domain).

In our case, we would like to have:

1. Internal users to authenticate against Azure AD login page (https://login.microsoftonline.com/common/oauth2/v2.0/authorize)
2. External users (if possible, without any email introdution, not sure if possible) to go to an external identity provider for authentication and authorization. This identity provider has authentication mechanisms that dont rely on email but on other Personal Identification Information such as VAT Number for instance.

Questions:

1. Will users always pass through the Azure AD login page (https://login.microsoftonline.com/common/oauth2/v2.0/authorize)?
2. If yes, how can we differentiate internal users from external users? Through the domain? Examples:
1. Domain.com - auth done directly in Azure AD without any redirection to custom identity provider
2. Externaldomain.com - domain configured as federated and thus being redirect to the custom login page from the identity provider
3. If no, how can we ensure that internal users go though the normal Azure AD authentication flow and external users go thought the custom login page from the identity provider?
4. Since the custom identity provider has authentication mechanisms that dont rely on email but on other Personal Identification Information such as VAT Number for instance, how can we ensure that the returned identity can be mapped to a valid Guest User in Azure AD that requires an email?
5. From my understanding, the Guest user in Azure AD must be created after authentication in the custom login page from the identity provider. How can we ensure that after authentication in the custom login page from the identity provider, the Guest User is created with a valid email address? The identity provider must supply a valid email (assuming email is available) to a custom page of ours that invokes the Create invition (https://docs.microsoft.com/en-us/graph/api/invitation-post?view=graph-rest-1.0&tabs=http) API?
6. Is it possible to have a custom form to override https://login.microsoftonline.com/common/oauth2/v2.0/authorize or the authentication entry point is always the the MS login page and the user has to enter a domain (the federated domain) in the MS login page to be redirected to the identity provider custom page for authentication and authorization?
7. Any more relevant details in the process?
8. What is the most complete guide available with all the steps necessary for this scenario?

Thanks

[#2]

Hello,

If it is for B2B, you should have a look at Azure B2B Collaboration : https://docs.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b

In short, Azure B2B enable to federate the authentication, to let you to invite external user as guest in your tenants. They will be able to consume your services (e.g., SharePoint Online) with their identity (and so their IdP).

All the guests users will have a specific UPN :
- If userA@contoso.com is invited
- His UPN will be : userA_contoso.com#ext#@yourconompany.onmicrosoft.com

In any case, the authentication to Azure AD goes through login.microsoftonlin.com or login.live.com


If it is for B2C, you should have a look at B2C
https://docs.microsoft.com/en-us/azure/active-directory-b2c/overview

[#3]

Hi,

Thanks for the info.
In our case, the invite seems not to be an option since the external identity provider is based on Oracle and the available auth methods don't rely on email.

External users will have to log in using one of the following methods:
- VAT Number and password (auth against a external system)
- Generic auth system that uses mobile number and MFA auth
- Internal form with user (not sure what this is yet) and password

How can invite and B2B work here?

Please take a look at all details I explain in the initial question.

Tks
Miguel