Applications: OpenID Connect, SAML and Microsoft 365

In this tutorial, we connect the organisation's applications: through OpenID Connect, through SAML, and Microsoft 365. People sign in with a passkey or the phone, and only once for all of them. First of all, the policy: publish a rule that allows application sign-ins. Without it, every sign-in is refused. For an OpenID Connect application, open Manage, OIDC services, and choose New service.

Enter the service identifier, the name people see, the type, the exact redirect addresses and the scopes. Require PKCE, and save. For a confidential service, issue the secret: it's shown only once. Hand it to the application team over a secure channel, with the issuer and the discovery document. To rotate without interruption, the two most recent secrets stay active.

For a SAML application, open Manage, SAML applications. Copy the identity provider details to the application: the identifier, the sign-in URL and the certificate. Then choose New application, import the metadata or pick a template, and confirm the identifier and the return addresses. The signing certificate lasts two years. Sixty days before it ends, the console warns you: add the next certificate, update every application, and only then switch.

For Microsoft 365, under Manage, Microsoft 365, create the federation for a verified domain, preferably a subdomain. Generate the people's anchors, download the configuration script, read it, and run it with an emergency global administrator. Keep Microsoft's privileged roles on onmicrosoft.com accounts, outside the federated domain. And test first in a test tenant.

Under Manage, Single sign-on, set how long the session lasts and the idle timeout. Mark critical applications as sensitive, such as cloud administration or payroll: those always ask for the passkey. For people, signing in to an application is the same as signing in to the console: their email, then a passkey or the phone. At the next application, they're already in.

And that's it: applications connected, with one strong sign-in. In the next tutorial, we'll cover phones and security settings.