Adding Microsoft 365 to PingOne - PingOne Cloud Platform - PingOne

PingOne Cloud Platform
bundle
pingone
ft:publication_title
PingOne Cloud Platform
Product_Version_ce
PingOne Cloud Platform
PingOne
category
Administratorguide
ContentType
Guide
Product
Productdocumentation
p1
p1cloudplatform
ContentType_ce
Guide
Product documentation
Guide > Administrator Guide

Use the application catalog to add Microsoft 365 to your application portal.

You must have a Microsoft Azure account with a custom domain configured in Azure Active Directory (AD)Active Directory (AD)AD A directory service for Windows domain networks, included in most Windows Server operation systems..

Note:

The IssuerURI value that PingOne provides during application configuration must be unique in Microsoft Azure. This means that two domains or subdomains within a single Azure account can't be connected to the same PingOne Office 365 application.

PingOne supports the Microsoft 365 passive and active profiles for single sign-on (SSO)single sign-on (SSO)sso The process of authenticating an identity (signing on) at one website (usually with a user ID and password) and then accessing resources secured by other domains without re-authenticating.. Passive profile enables web browser SSO, while active profile is used by native clients, such as mobile devices and email clients. To authenticate with an active profile, users must provide their PingOne username and password to the client. Microsoft verifies these credentials with PingOne using the WS-Trust protocol.

If the PingOne environment is configured with an LDAP Gateway, these credentials can be validated against Active Directory. For more information, see Gateways.

  1. Go to Applications > Application Catalog.
  2. In the Search for applications field, enter Microsoft 365.
  3. Click the Microsoft 365 entry to open the details panel.
  4. On the Quick setup page, review the following:
    • Name: Enter a new name to replace the default application name (optional).
    • Icon: Select a new image to replace the default application icon (optional).
    • Domain name: Enter the <Custom Domain> value from your Azure AD account. You can find your <Custom Domain> in the Azure AD portal by going to Azure Active Directory > Custom Domain Names.
    Note:

    If the application has already been configured, click View in Applications list to view the full configuration.

  5. Click Next.
  6. On the Map Attributes page, select the PingOne attributes to map to the required UPN and ImmutableID Microsoft 365 attributes.
    Note:

    ImmutableID uniquely identifies a user in Azure AD. You can find the ImmutableID value by running the Get-MsolUser command in Powershell after you configure federation with Azure AD. For more information, see Get-MsolUser in the Microsoft documentation.

    For UPN, use an email address with a domain name that matches the domain name registered with Microsoft 365.

    Consider the following:

    • If your user identities are stored in the PingOne Directory, use the default mapping of ImmutableID to ExternalID. ExternalID is the user's User ID in PingOne.

    • If the Microsoft 365 users are migrated into PingOne from AD through the LDAP Gateway and the source of the ExternalID is the objectGUID or ms-DS-ConsistencyGuid, add an expression to the mapping configuration. Locate the ImmutableID mapping, and click the gears icon to open the expression builder. Enter the following expression:

      #string.uuidAsBase64Guid(user.externalId,null)

      For more information, see Using ms-DS-ConsistencyGuid as sourceAnchor in the Microsoft documentation.

    • You can create a custom PingOne user attribute instead of using ExternalID. Map objectGUID or ms-DS-ConsistencyGuid as the attribute source. Locate the ImmutableID mapping, and click the gears icon to open the expression builder. Enter the following expression:

      #string.uuidAsBase64Guid(user.customAttrName,null)

      where customAttrName represents the custom PingOne user attribute. You can also replace null with a custom value, such as an error.

  7. Click Next.
  8. On the Select groups page, click the name of the user groups that you want to have access to the application. You can browse or search for groups. Click the Added tab to see the groups that currently have access to the application.
    Note:

    By default, all users have access to the application. Assigning groups restricts application access to those groups only.

  9. Click Save.
  10. After you’ve created the application, click the application entry to open the details panel.
  11. Click the View in Applications list link.
  12. Click the Configuration tab.
  13. Determine which cmdlets to use.
    • If you have upgraded to Graph PowerShell, locate the Microsoft Graph PowerShell cmdlets.
    • If you have not upgraded to Graph PowerShell, locate the MSOnline cmdlets.
  14. Do one of the following:
    • If you are setting up identity federation settings for the first time to use PingOne as the identity provider, locate either Microsoft Graph PowerShell cmdlets or MSOnline cmdlets, depending on your configuration. Click the Copy to clipboard button on the right side for the appropriate section.
    • If you are updating existing identity federation settings to use PingOne as the identity provider, locate the Execute following cmdlets in PowerShell to change existing federation settings section. Click the Copy to clipboard button on the right side.
      Note:

      You might have to scroll to the right to see the Copy to clipboard button.

      You might have to collapse the Microsoft Graph PowerShell cmdlets entry to see the MSOnline cmdlets entry.

  15. Open Windows PowerShell.
  16. In PowerShell, paste the copied commands and run them.

    These commands update the domain authentication in Azure AD to SSO.

    For more information, about the Microsoft cmdlets that are used in PingOne, see the following topics in the Microsoft documentation:

You can enable Kerberos authentication for Microsoft 365 apps (optional). For more information, see Enabling Kerberos authentication.