# Microsoft 365

> Federate Microsoft 365 with AD FS and Ironchip MFA: install Microsoft Entra Connect, set up UPN suffixes, federate the domain, and test sign-in with push.

URL: https://docs.ironchip.com/en/identidad/integraciones/saas/microsoft-365/

This guide explains how to federate Microsoft 365 with your AD FS server integrated with Ironchip, so that users in protected groups must pass Ironchip MFA.

:::caution[The sign-in experience changes]
During setup, Microsoft 365 is configured as part of a federation farm whose main server is the Windows Server where you install. Because of this, the sign-in experience changes: during sign-in, users are redirected to that server. Take this into account before you start the installation.
:::

## Requirements

- The Windows Server machine must have an assigned domain and an associated FQDN accessible from the internet.
- To integrate AD FS on a local server, you need a certificate associated with that domain, issued by a valid certificate authority. AD FS must have access to the private key and needs the certificate in PFX format.
- The domain assigned to the machine in Azure must be validated. To do so, add to your DNS the record Azure requires to verify domain ownership.

## Configure Ironchip

The first step is to configure AD FS and the Ironchip AD FS plugin. Follow the [ADFS](https://docs.ironchip.com/en/identidad/integraciones/saas/adfs/) guide.

Once AD FS is configured correctly, continue with the Microsoft 365 federation.

## Configure Microsoft 365

### Install Microsoft Entra Connect

1. Download [Microsoft Entra Connect (formerly Azure AD Connect)](https://www.microsoft.com/en-us/download/details.aspx?id=47594).
2. When the download finishes, run the installer on the Windows Server where you set up AD FS integrated with Ironchip.
3. When prompted, select **Express** settings.
4. In the **Connect to Azure AD** step, enter the credentials of a Microsoft Entra ID (formerly Azure AD) global administrator.
5. In the **Connect to AD DS** step, enter the credentials of an Active Directory administrator on the Windows Server.
6. In the **Azure AD sign-in** step, check that the domain shown in the **Azure AD Domain** column has a **Verified** state. If the domain you want to federate isn't verified, follow [this Microsoft guide to verify it](https://learn.microsoft.com/en-us/entra/fundamentals/add-custom-domain#verify-your-custom-domain-name).

   [Image: Azure AD sign-in step of the installer showing the domain and its state]

7. If the installer doesn't let you continue, you can select the **Continue without matching all UPN suffixes to verified domains** checkbox. You create the UPN suffixes later, if needed.
8. Click **Next**. The installation starts at the **Configure** step.

### Configure the UPN suffixes

Skip this section if the installer didn't ask you to select the **Continue without matching all UPN suffixes to verified domains** checkbox.

1. On the Windows Server, open **Active Directory Domains and Trusts**.
2. Right-click the first item in the list and select **Properties**.

   [Image: Active Directory Domains and Trusts properties to add the UPN suffix]

3. Enter the domain exactly as it appears in Azure and click **Add** to enable the UPN suffix.
4. Close the tool. The suffix is now configured.

### Federate the domain with your local AD FS

1. Open Microsoft Entra Connect on the Windows Server and click **Configure**.
2. In the task list, select **Manage federation** and then **Federate Azure AD domain**.
3. In the **Connect to Azure AD** step, enter the credentials of an Entra ID global administrator.
4. In the **Connect to AD FS** step, enter the credentials of an Active Directory administrator on the local server.
5. In the **Azure AD domain** step, select a federable Entra ID domain under **DOMAIN**. For the domain to be available, it must already be validated. The installer warns that the domain will be converted from managed to federated and that user sign-ins will be disrupted during the process.

   [Image: Azure AD domain step in Microsoft Entra Connect with the drop-down to choose the domain to federate]

6. Read the messages in the **Azure AD trust** step and click **Next**. The federation process starts.

## Verify the integration

AD FS synchronization can take a while. While it runs, users may keep signing in to the service as before, without being asked for multi-factor authentication.

1. Try to sign in to your Microsoft 365 account. The sign-in process should have changed and redirect you to your Windows Server for a unified SSO experience.

   [Image: AD FS server sign-in page that Microsoft 365 redirects to]

2. If the Ironchip plugin is configured correctly and the user belongs to a group protected with Ironchip MFA, the user is asked to allow access with a push notification on their authenticator.

   [Image: AD FS page asking you to authenticate in Ironchip with the Send Push Notification button]

## Ask for credentials when local Windows applications start

To make local Windows applications ask for credentials each time the user connects, set up a GPO with these parameters:

1. Delete all files in this folder each time the user signs out:

   ```text
   %LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts
   ```

2. Add this entry to the Windows registry:

   ```text
   HKLM\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin
   DWORD: BlockAADWorkplaceJoin
   VALUE: 1
   ```

3. Set this value in the GPO:

   ```text
   Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
   Value: Users can't add Microsoft accounts
   ```