Microsoft 365

This guide explains how to federate Microsoft 365 with your AD FS server integrated with Ironchip, so that users in protected groups must pass Ironchip MFA.

The sign-in experience changes

During setup, Microsoft 365 is configured as part of a federation farm whose main server is the Windows Server where you install. Because of this, the sign-in experience changes: during sign-in, users are redirected to that server. Take this into account before you start the installation.

Requirements

• The Windows Server machine must have an assigned domain and an associated FQDN accessible from the internet.
• To integrate AD FS on a local server, you need a certificate associated with that domain, issued by a valid certificate authority. AD FS must have access to the private key and needs the certificate in PFX format.
• The domain assigned to the machine in Azure must be validated. To do so, add to your DNS the record Azure requires to verify domain ownership.

Configure Ironchip

The first step is to configure AD FS and the Ironchip AD FS plugin. Follow the ADFS guide.

Once AD FS is configured correctly, continue with the Microsoft 365 federation.

Configure Microsoft 365

Install Microsoft Entra Connect

1. Download Microsoft Entra Connect (formerly Azure AD Connect).

2. When the download finishes, run the installer on the Windows Server where you set up AD FS integrated with Ironchip.

3. When prompted, select Express settings.

4. In the Connect to Azure AD step, enter the credentials of a Microsoft Entra ID (formerly Azure AD) global administrator.

5. In the Connect to AD DS step, enter the credentials of an Active Directory administrator on the Windows Server.

6. In the Azure AD sign-in step, check that the domain shown in the Azure AD Domain column has a Verified state. If the domain you want to federate isn’t verified, follow this Microsoft guide to verify it.

   

7. If the installer doesn’t let you continue, you can select the Continue without matching all UPN suffixes to verified domains checkbox. You create the UPN suffixes later, if needed.

8. Click Next. The installation starts at the Configure step.

Configure the UPN suffixes

Skip this section if the installer didn’t ask you to select the Continue without matching all UPN suffixes to verified domains checkbox.

1. On the Windows Server, open Active Directory Domains and Trusts.

2. Right-click the first item in the list and select Properties.

   

3. Enter the domain exactly as it appears in Azure and click Add to enable the UPN suffix.

4. Close the tool. The suffix is now configured.

Federate the domain with your local AD FS

1. Open Microsoft Entra Connect on the Windows Server and click Configure.

2. In the task list, select Manage federation and then Federate Azure AD domain.

3. In the Connect to Azure AD step, enter the credentials of an Entra ID global administrator.

4. In the Connect to AD FS step, enter the credentials of an Active Directory administrator on the local server.

5. In the Azure AD domain step, select a federable Entra ID domain under DOMAIN. For the domain to be available, it must already be validated. The installer warns that the domain will be converted from managed to federated and that user sign-ins will be disrupted during the process.

   

6. Read the messages in the Azure AD trust step and click Next. The federation process starts.

Verify the integration

AD FS synchronization can take a while. While it runs, users may keep signing in to the service as before, without being asked for multi-factor authentication.

1. Try to sign in to your Microsoft 365 account. The sign-in process should have changed and redirect you to your Windows Server for a unified SSO experience.

   

2. If the Ironchip plugin is configured correctly and the user belongs to a group protected with Ironchip MFA, the user is asked to allow access with a push notification on their authenticator.

   

Ask for credentials when local Windows applications start

To make local Windows applications ask for credentials each time the user connects, set up a GPO with these parameters:

1. Delete all files in this folder each time the user signs out:

   %LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts

2. Add this entry to the Windows registry:

   HKLM\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin
   DWORD: BlockAADWorkplaceJoin
   VALUE: 1

3. Set this value in the GPO:

   Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
   Value: Users can't add Microsoft accounts