Chromebook / Office365 Authentication

[snagrat]

I am looking at starting to setup the ability to login to Chromebooks with Office 365 credentials.

 

Previously I believed that by enabling this meant that all users in GSuite would be required to authenticate to AAD, so any existing GSuite would no longer work.

 

However Google were introducing this on a Per OU level.

 

Does anyone know if this is possible yet? I do not want existing GSuite users to be affected by me enabling this.

[techy32]

I am also interested to know this.... Keeping a close eye on this thread.

[Michael]

If you've provisioned users from AD > Azure > G Suite or just Azure > G Suite, it'll work signing into a Chromebook. Linking Azure to G Suite will provision real Google accounts so you can login to any Google service.

[snagrat]

If you've provisioned users from AD > Azure > G Suite or just Azure > G Suite, it'll work signing into a Chromebook. Linking Azure to G Suite will provision real Google accounts so you can login to any Google service.

 

So doing it this why does Azure send the password to the provisioned Google account as well?

[Michael]

Azure remains the ID Provider and they're bound by a certificate. I can only presume it's a hashed token that's sent to G Suite?

[snagrat]

Azure remains the ID Provider and they're bound by a certificate. I can only presume it's a hashed token that's sent to G Suite?

 

So that’s the problem I believe. Google does not support multiple identity providers and therefore if you enable this then it is for all Google users, not just a selection.

[Michael]

You can either do select users or the whole Azure tenancy. Then whatever the selection into G Suite.

 

What happens if you have existing users in G Suite, or manually create users in G Suite - I'm not 100% sure, but I see no issue so long as they don't match. If they did match, I'm not sure what happens in this scenario.