Google SSO - Using different domains between Azure and Google

[snagrat]

I've setup Google and Azure SSO a few times now and its been pretty straight forward. But on my later project I am needing to do it when the domains are different between the 2 cloud providers and I am not sure it is possible.

 

In Google we have domain1.com and all users have this as their primary domain.

In Azure we have domain2.com which all users have as their primary domain. We can add domain1.com as an alias.

 

We cannot add domain2.com to Google as it currently exists in another tenant that will be staying. Ultimately we will be moving domain1.com to the domain2.com tenant but not for a little while.

 

Is it possible to setup Azure SSO through Google so a subnet of users that login with domain2.com (domain1.com as alias) are SSO into their domain1.com Google account?

[localzuk]

Which way round are you doing the SSO? With Azure AD as the authenticator, or Google?

 

If Azure is the authenticator, and Google is being handed the token saying the user has signed in, you can do what you want as you would link the 2 using a custom field anyway to get it to work - we have a custom field "ImmutableID" in Google, and we export them from AzureAD and import them into Google using GAM.

 

So, the matching is done on that, and not the domain.

 

The other way round, I'm not sure, sorry.

[snagrat]

Azure will be the authenticator.

 

That sounds like a good plan and what I need. So is it on the Google side that you set what field the token uses to confirm the user?

 

You must automate the GAM process for when new users arrive etc?

[snagrat]

Which way round are you doing the SSO? With Azure AD as the authenticator, or Google?

 

If Azure is the authenticator, and Google is being handed the token saying the user has signed in, you can do what you want as you would link the 2 using a custom field anyway to get it to work - we have a custom field "ImmutableID" in Google, and we export them from AzureAD and import them into Google using GAM.

 

So, the matching is done on that, and not the domain.

 

The other way round, I'm not sure, sorry.

 

Any chance of any more help on this localzuk?

 

I've created a field in Google called ImmutableID and have exported the string from Azure and added it to the field for my test user. But it doesn't work.

 

I am playing around with the Attributes and Claim section in Azure, thinking it would need to be tweaked to ensure the ImmutableID is used as the anchor but that isn't an option

 

Thanks in advance