Has anyone federated from Google Workspace to Azure AD?

[TwistedHelixis]

We have all our users in G Workspace, but also have a need for users to be able to access some MS cloud features.

 

As I understand it, the best (simplest) way is to get Azure to grab our current G Workspace users and authenticate against those.

 

It seems that lots of forums posts are about going from Azure to Workspace, and I am wondering if anyone on Edugeek has gone from Workspace to Azure?

[RLR]

Also interested in this. We mainly use Google in our enviroment but still have an Azure AD instance using Azure AD Connect. I setup Google Federation but I believe this is only to create accounts in Azure AD if it doesn't exist. But as we're using Azure AD Connect the users are already there. Ideally, I'd like to use Google as the Identity Provider and have our users sign into their google account to use other Azure services such as office 365.

[Oaktech]

Watching... We have a fully working Workspace but our MAT are asking us to go Azure cloud based for everything. I don't want to reinvent the wheel so federating AAD against Workspace seems like a good solution.

[jblackburnHWGA]

I've got this setup the other way. We're Azure based but use Google for Chromebooks.

I believe you need to make sure your google domain and azure domain match.

 

I asked on the Google chat / helpdesk and they sent me the right guides i needed.

[DGardiner]

Watching... We have a fully working Workspace but our MAT are asking us to go Azure cloud based for everything. I don't want to reinvent the wheel so federating AAD against Workspace seems like a good solution.

 

do you have many users in your AAD?

 

Its pretty straight forward to do - Our only issue was we had to change the immutable IDs of existing users.

[DGardiner]

Heres the how to

https://support.google.com/a/answer/7365072?product_name=UnuFlow&visit_id=638054166365467553-3886646535&rd=1&src=supportwidget0

[RLR]

Heres the how to

https://support.google.com/a/answer/7365072?product_name=UnuFlow&visit_id=638054166365467553-3886646535&rd=1&src=supportwidget0

 

That's great. Will have to have a look through this. I've also just found https://docs.google.com/document/d/1wOND3TchK125QIFiFL19WaknVJ40WH0G8QpD91U9-0w/edit# which may help others.

[Oaktech]

do you have many users in your AAD?

 

Its pretty straight forward to do - Our only issue was we had to change the immutable IDs of existing users.

 

If we fully replicate Google to AAD we'd have about 730 users of which about 610 would be students, 90 would be licensed staff, 15 would be governors and 15 would be service accounts.

[TwistedHelixis]

This might be a dumb question, but both of those links go over user provisioning from Workspace to Office 365, would those users then also be in Azure AD?

[PrimaryNetMan]

Interested in this too.

 

Started looking into this a month or so ago. Managed to get it so Google Workspace federated with an O365 tenancy. New Google Workspace users show up in the O365 tenancy.

 

When you sign in at O365 you get redirected to Google to sign in.

 

But then when it goes to send you back to O365 I get the following

 

 

So if anyone has any ideas that would be great.

[PrimaryNetMan]

Interested in this too.

 

Started looking into this a month or so ago. Managed to get it so Google Workspace federated with an O365 tenancy. New Google Workspace users show up in the O365 tenancy.

 

When you sign in at O365 you get redirected to Google to sign in.

 

But then when it goes to send you back to O365 I get the following

 

[ATTACH=CONFIG]67318[/ATTACH]

 

So if anyone has any ideas that would be great.

 

And in typical IT fashion, in returning to the issue I have managed to fix the issue. In the initial setup I had used our custom schema MisId in Google as the ImmutableID.

 

Instead I created a schema AzureAD, field ImmutableID and set the UPN as the ImmutableID

 

I changed the O365 AAD user ImmutableID to the UPN and SSO now works.

Edited November 30, 2022 by PrimaryNetMan

[TwistedHelixis]

And in typical IT fashion, in returning to the issue I have managed to fix the issue. In the initial setup I had used our custom schema MisId in Google as the ImmutableID.

 

Instead I created a schema AzureAD, field ImmutableID and set the UPN as the ImmutableID

 

I changed the O365 AAD user ImmutableID to the UPN and SSO now works.

Are the steps you followed similar to the steps linked above? Can you post the steps if not.

[TwistedHelixis]

Perhaps Federated is not what I am after.

 

Will federating from Google to MS mean I have a list of the users in Azure AD? Basically a copy of the users in both systems (same username, email address and same password). Or do they sign-in to a MS system, but Google authenticates the user, but Azure doesn't have those users listed.

 

The reason I am asking is, even though we are a Google Workspace school I will eventually want our users laptops to login to the cloud, not our onsite AD server. And I will probably need in-tune & Azure AD to manage those devices and users.

 

Perhaps someone can enlighten me what I actually need to achieve this.

[jblackburnHWGA]

The federation logs the users in as the other account based on the federated credentials.

 

so, we are Azure AD. If you go to a site and select login using a google account. When you enter your e-mail account it will push you through to Azure for your credentials. Using your credentials, you are then logged in as your google account not your Azure account. The google account links to the azure account.

When set up correctly you can configure the Azure account to automatically create the Google account for you. Your users don't need to know the Google details

 

It works the other way round with google being your main platform. If you click log in with MS on a site and enter your e-mail it will push you to Google sign in to sign in which logs you in with the linked Azure account.

You can again configure Google to make the Azure account for you automatically based on your google account details

[PrimaryNetMan]

Once setup When you add a new user to Google Workspace a user is automatically created in Office 365 / AAD. When you attempt to login to MS using this new email you'll get redirected to Google to sign in and then sent back to Microsoft all authenticated.

 

Being a Google first school, I'm setting up for the same reasons you are. Just need t get some Intune licences now.

[DGardiner]

just to add, from this mornings tickets.... renaming users in Google means you have to manually change the immutableID in 365 to match the upn in google

[TwistedHelixis]

Just reading the links in other posts and noticed this at the start of one...

 

Before You BeginAdd your Google Workspace domain to the Microsoft environment in the Custom domain names settings for Azure.NB: Do not set it as the Primary Domain.

 

I have already setup 365 (and Workspace) with our domain as primary. Do I need to change this?

[k-strider]

We moved a Primary school from RM unify to Google as the IdP in Azure.

First we un federated the o365 domain (make sure you have a super admin on their onmicrosoft domain)

then we set the imutible id to their email address which is what is needed for google then we were able to setup google as the idp

[k-strider]

i was trying to find the scripts we used to do this on mass but i cant find them grrh this is liying around for individual ones

# Checking the original ImmutableID

get-msoluser -UserPrincipalName [email protected] | select *immutableid*

# Changing it to a "onmicrosoft" UPN

set-MsolUserPrincipalName -UserPrincipalName [email protected] -NewUserPrincipalName [email protected]

# Setting a new Immutable ID from on-prem AD

set-MsolUser –UserPrincipalName [email protected] -ImmutableId [email protected]

# Check that the change was applied

get-msoluser -UserPrincipalName [email protected] | select *immutableid*

# Changing it back to the original UPN

set-MsolUserPrincipalName -UserPrincipalName [email protected] -NewUserPrincipalName [email protected]

# Checking that the UPN is now correct and the correct ImmutableID is applied

get-msoluser -UserPrincipalName [email protected] | select *immutableid*

[k-strider]

this is the website i used to learn the way to set this up

https://www.goldyarora.com/g-suite-to-office-365-sso/

[k-strider]

Found this on the c drive of the Technician Computer where i sat down and did this.... i think because the domain was unfederated at the time i could just change the imutible id without changing the UPN

the CSV had these columns UPN id onms ImmutableId WhenCreated

$cred = Get-Credential
   Import-Module MSOnline
   
   Write-Host "Connecting to domain using credentials provided..."
   
   Connect-MsolService -Credential $cred
$users = Import-Csv -Path c:\temp\users2.csv 

foreach ($user in $users)
{

$UPN = $user.UPN
$onms = $user.onms
$id = $user.id

get-msoluser -UserPrincipalName $UPN | select *immutableid*

set-MsolUser -UserPrincipalName $UPN -ImmutableId $id

# Checking that the UPN is now correct and the correct ImmutableID is applied
get-msoluser -UserPrincipalName $UPN | select *immutableid*
}

And this one for later if users needed to be changed after refederating here it does the whole upn change

$cred = Get-Credential
   Import-Module MSOnline
   
   Write-Host "Connecting to domain using credentials provided..."
   
   Connect-MsolService -Credential $cred
$users = Import-Csv -Path c:\temp\users3.csv 

foreach ($user in $users)
{

$UPN = $user.UPN
$onms = $user.onms
$id = $user.id

get-msoluser -UserPrincipalName $UPN | select *immutableid*
# Changing it to a "onmicrosoft" UPN
set-MsolUserPrincipalName -UserPrincipalName $UPN -NewUserPrincipalName $onms
# Setting a new Immutable ID from on-prem AD
set-MsolUser -UserPrincipalName $onms -ImmutableId $id
# Check that the change was applied
get-msoluser -UserPrincipalName $onms | select *immutableid*
# Changing it back to the original UPN
set-MsolUserPrincipalName -UserPrincipalName $onms -NewUserPrincipalName $UPN
# Checking that the UPN is now correct and the correct ImmutableID is applied
get-msoluser -UserPrincipalName $UPN | select *immutableid*
}

Edited December 1, 2022 by k-strider

[RLR]

Is azure ad connect not required if users are automaticlly created based on Google Federation?

[Oaktech]

Is azure ad connect not required if users are automaticlly created based on Google Federation?

 

Azure AD connect is only not required if you don't have on-prem infrastructure...

[k-strider]

No AD connect will sync on prem AD infrastruture with Azure if you want to federate with google using the method i posted above any accounts in google will be provisioned in Azure / office 365

[RLR]

Think I'm ready to give this a go and setup. Looks like I'll need to change all the user ImmutableIDs to their email address to make it more straight forward.

 

One question if anyone is able to help. When new users are created, their immutableID will be randomly generated due to Azure AD Sync creating the accounts. Is there a way to force new users to be with their email address as their ImmutableID? Otherwise we'll have to remember to update the ID for each new user. Worst case, I could script this.

 

Edit: Think I found my answer. We would have to keep updating the immutableIDs if we want to use Azure AD Sync. The other option is to use the currunt immutableIDs and create a custom attribute in google that we can sync (possibly using gam to keep up-to-date).

Edited December 5, 2022 by RLR