Microsoft/Azure – Federation to TraitWare

Posted on May 1, 2024

Overview

In order to use TraitWare to sign into Microsoft online products, it is required to federate the domain. Please ensure that the previous GraphAPI sync to TraitWare is configured and functioning.

Note: Microsoft federation is domain level. Non-disruptive user testing requires a secondary domain.

• Preparing Azure
• Add / Assign Global Admin
• Create Microsoft Application
• Running the Powershell Script

Preparing Azure

1. Make sure the account has more than one verified domain. Federation requires that one domain remains unfederated (Primary Managed domain). TraitWare recommends selecting the .onmicrosoft.com domain as the primary.  A Powershell Script will be run to complete federation.

Add/Assign Global Administrator

1. Next, add a Global Administrator. This user will not use TraitWare to sign in. This account does not require licenses from Microsoft. If there is already a global user setup, skip to Setting up users for Testing.
2. Navigate to Entra ID → Users → + New User 
3. Fill in the appropriate information for the Name and User name (email)

4. Select Assignments, Add role and change to Global Administrator then select Ok. Then select Review + Create

5. If the account already has an existing user that is preferred as the global administrator, navigate to Entra ID → Roles and administrators → Global Administrator

6. Select + Add member and search for the appropriate user to add as a member

**Note: It is highly recommended to use security best practices when creating a password.

Create Microsoft Application

Create Signing Key:

1. Navigate to the Signing Keys at the applications menu of the TratiWare console. Click the plus sign to add a new signing key. 

2. Enter display name, select desired Lifetime in Years.  Click Generate Key.

3. Create Application.

4. Choose the SAML application type.

5. Enter the Name for the application. Select Use a Template.

6. Search for ‘Microsoft’, select Microsoft Cloud Logins, and click Submit.

7. Select the newly-created application.

8. Click on Signing Key under the Configuration tab to expand that section. Click Edit Signing Key.

9. Select the previously-created signing key.

10. Click the Provider Credentials tab to find information needed for the Powershell federation script.

11. Click the Provider Credentials tab to find information needed for the Powershell federation script.

Running the Powershell Script

Prior to executing the Powershell commands, please ensure that the following have been completed and are available:

• Global User Created (within the onmicrosoft.com domain)
• More than one verified domain
• TraitWare SAML Endpoint
• TraitWare SAML Signing Certificate
• TraitWare Issuer

1. Open Powershell (ISE is recommended for ease of use).
2. Install the MsOnline Module in Powershell by running the following command:

3. Select Yes to all and let the scripts run. Once that is complete, connect to Azure using the Global Admin credential and run the following:

4. A window will open up, enter the Global Admin username and password. The next step will federate the domain:

5. An example of this would be:

6. If it is required to change the domain back to managed, run the following after Connect-MsolService:

Note: This will disable TraitWare authentication for the Microsoft domain.