Applying ADFS in Office 365

[FN-GM]

Hiya,

 

We will be switching from the DIR Sync with passwords to ADFS. I have got my servers setup, really easy to do by the way! When I finish off and tell office 365 we have ADFS I assume I disable password sync in DIRSYNC?

 

Thanks

Edited March 4, 2014 by FN-GM

[EduTech]

Hi,

 

when you are ready to convert your domain from managed to federated, I recommend the following steps [high level]

 

- Disable Password Sync [you do this by re-running the configuration wizard and unchecking the password sync option]

- Logon to AD FS Server, Launch PowerShell

- Connect to Office 365 and then run the commands to convert the domain, to create the Relying Party etc.

 

Regards,

James.

[FN-GM]

Cheers, thought so just wanted to be sure. To convert them its just a case of doing this in powershell?

 

Set-MsolADFSContext

Convert-MsolDomainToFederated -DomainName example.com -SupportMultipleDomains:$true

 

Thanks again.

[EduTech]

The PowerShell Commands would be as follows

 

Connect-MsolService

Set-MSOLAdfscontext

Convert-MsolDomaintoFederated -DomainName contoso.com -supportmultipledomain

 

NOTE: you only need support multiple domain, if you plan on adding multiple top level domains.

 

Thanks,

James.

[FN-GM]

So its the same as i put (ish) We do have more than 1 domain.

 

Would you do the same if you wanted to do the same for a completely separate Office 365 tenant but the users stay on the same domain? Or will it stuff things up?

 

Cheers pal.

Edited March 4, 2014 by FN-GM

[EduTech]

So its the same as i put (ish) We do have more than 1 domain.

 

Would you do the same if you wanted to do the same for a completely separate Office 365 tenant but the users stay on the same domain? Or will it stuff things up?

 

Cheers pal.

 

Hi,

 

If you have more than one domain that you want to federate in the same tenant then you need to use the supportmultipledomain syntax in the command.

 

You are not able to add the same vanity domain into a different tenant, you would have to remove it from the first tenant beforehand.

 

James.

[FN-GM]

Hi,

 

I dont mean add the same public domain i mean the same Windows domain.

 

If i had 2 separate office 365 tenants. They use there own public domains. They share a windows domain. How do i sort ADFS to work with the 2 separate tenants on one windows domain please?

 

Cheers

Edited March 4, 2014 by FN-GM

[EduTech]

Hi,

 

I dont mean add the same public domain i mean the same Windows domain.

 

If i had 2 separate office 365 tenants. They use there own public domains. They share a windows domain. How do i sort ADFS to work with the 2 separate tenants on one windows domain please?

 

Cheers

 

so, in this scenario you would basically need to ensure that you only synchronized the users to the respective tenant using OU Filtering for example... then you would need to create 2 separate AD FS Instances.. (different service account, different STS endpoint etc.) and then you would add one federated domain to instance A and then the other federated domain to instance B.

 

I have a very similar setup for repro purposes...

 

James.

[FN-GM]

When you say 2 instances, do you mean on the same ADFS servers or new set of servers? cheers Edited March 5, 2014 by FN-GM

[EduTech]

They will need to be separate instances (as in separate servers) as you can't have two relying parties with the same identifier on the same instance.

[jamesbmarshall]

They will need to be separate instances

 

Are you sure?

 

I don't have the time to test, but I'm pretty sure that you can have a single AD FS farm serving multiple TLDs and I can't find any documentation that differentiates between multiple TLDs in a single tenant, or across many.

 

My brain might be forgetting stuff though, it's been a while now since I last looked at this and as much as I'd love to dive into my test rig I am focused on Windows now!

[EduTech]

Are you sure?

 

I don't have the time to test, but I'm pretty sure that you can have a single AD FS farm serving multiple TLDs and I can't find any documentation that differentiates between multiple TLDs in a single tenant, or across many.

 

My brain might be forgetting stuff though, it's been a while now since I last looked at this and as much as I'd love to dive into my test rig I am focused on Windows now!

 

Yeah, so basically if you do not federated the top level domain each sub-domain will be classed as a root domain in terms of Office 365. If you federated sub-domain A to 1 AD FS Server then when you attempt to add Sub-Domain B to the same server it will error...

 

This is I am understanding what the question is here correct. My brain is also fried at the moment #BUSY!

 

James :-)