Federate a Microsoft 365 domain (WS-Federation)

With federation, the people of a Microsoft Entra ID custom domain sign in to Microsoft 365 with this service's passkey, phone approval or single sign-on. Entra stays Microsoft 365's directory. The Microsoft-side behaviour comes from Microsoft's documentation: test in a test tenant first.

Most important security rule

Whoever can change anchors can sign in to Microsoft 365 as any user of the federated domain. Keep every privileged Microsoft role on *.onmicrosoft.com accounts, never on the federated domain, and keep the administrator group small.

Prepare the Microsoft side

1. Two emergency Global Administrators on *.onmicrosoft.com, with a FIDO2 key, excluded from every conditional access policy.
2. A verified custom domain (we recommend a subdomain, for example m365.example.com). Do not make it the default and do not federate the parent domain.
3. Test users with a UPN in the domain and, here, people with the same email and a passkey.

Prepare this service

1. The organization's WS-Federation signing key is created by the operations team. Without it: «The Microsoft 365 signing key is not configured for this organisation. Ask the operator to add it.»
2. A policy rule that allows federation.authorize for wsfed: followed by the federation's identifier.
3. Under «Manage» › «Microsoft 365», choose «New federation», enter the «Federated domain» and the name, and choose «Save federation». Do not change the «Authentication method (advanced)». The domain cannot change later.
4. Create the anchors. See Microsoft 365 anchors.

The setup script

1. Choose «Download setup script» (authguard-m365-<domain>.ps1). Download it again after any change.
2. Read it all and run it in PowerShell 7 as a *.onmicrosoft.com Global Administrator. The script writes the ImmutableIDs, federates the domain and shows the authentication type, which must be Federated.

Conditional access

Use "Require multifactor authentication" for the federated domain's people. Entra's "Phishing-resistant MFA" strength does not accept a federated provider's claim.

Going back

As a *.onmicrosoft.com Global Administrator: Update-MgDomain -DomainId 'm365.example.com' -AuthenticationType 'Managed'. People sign in at Microsoft again and need a Microsoft credential. The full command is in a comment at the end of the script.

Not supported

WS-Trust (old clients, and Windows sign-in on Entra-joined devices for federated people) and FederationMetadata.xml.