Google with Azure AD SSO

[mattysmith80]

Hi there was wondering if someone might be able to help, I have SSO working on chromebooks works really well, but the issue I am facing is that the Microsoft Page I am presented with requires the full email address to be entered. Ideally for younger students I just want them to enter their username not the full email bit, is there a way of pre populating the Azure AD page with the domain like you can with the google sign in page?

 

Many thanks

[EssentialRug]

Hi there was wondering if someone might be able to help, I have SSO working on chromebooks works really well, but the issue I am facing is that the Microsoft Page I am presented with requires the full email address to be entered. Ideally for younger students I just want them to enter their username not the full email bit, is there a way of pre populating the Azure AD page with the domain like you can with the google sign in page?

 

Many thanks

 

Have been looking for this also for quite some time...as far as I know there is no solution to this unfortunately

[mattysmith80]

So, after loads of time and trial and error ive finally got it passing the username from the initial page to the Azure AD logon page.....

 

In Device Setting you need to have

 

Single sign-on IdP redirection - Take users to the default Google Sign in Screen.....

 

In User and Browser Settings you need to have

 

Single sign-on IdP redirection - Allow users to go directly to the SAML IdP Page

 

Now for the important bit..... (this will pass the username entered at the initial Google Page to the Azure AD Page)

 

in Device Settings

 

Autofill Username on SAML ldP page - URL Parameter Name - set this to login_hint

[snagrat]

So, after loads of time and trial and error ive finally got it passing the username from the initial page to the Azure AD logon page.....

 

In Device Setting you need to have

 

Single sign-on IdP redirection - Take users to the default Google Sign in Screen.....

 

In User and Browser Settings you need to have

 

Single sign-on IdP redirection - Allow users to go directly to the SAML IdP Page

 

Now for the important bit..... (this will pass the username entered at the initial Google Page to the Azure AD Page)

 

in Device Settings

 

Autofill Username on SAML ldP page - URL Parameter Name - set this to login_hint

 

That seems an extra step though just to remove the need to enter the email domain?

[mattysmith80]

not when you have primary school kids who struggle to enter a username and a password in most cases.....

[dmj]

I can't help thinking this is the wrong way around.

Isn't all the MFA stuff and context aware access (ip restrictions, encrypted drives etc) free on google education standard but extra cost on azure ?

[mattysmith80]

We are a microsoft shop with 35 schools, but have about 1,500 DFE laptops that are should we say... very poor Windows machines, but very quick ChromeOS Flex machines.... So I am coming at this from a "Making Google Work with Microsoft" angle...

[EssentialRug]

So, after loads of time and trial and error ive finally got it passing the username from the initial page to the Azure AD logon page.....

 

In Device Setting you need to have

 

Single sign-on IdP redirection - Take users to the default Google Sign in Screen.....

 

In User and Browser Settings you need to have

 

Single sign-on IdP redirection - Allow users to go directly to the SAML IdP Page

 

Now for the important bit..... (this will pass the username entered at the initial Google Page to the Azure AD Page)

 

in Device Settings

 

Autofill Username on SAML ldP page - URL Parameter Name - set this to login_hint

 

Brilliant. Any way to do this on non Chrome devices?

[jonnykewell1]

So, after loads of time and trial and error ive finally got it passing the username from the initial page to the Azure AD logon page.....

 

In Device Setting you need to have

 

Single sign-on IdP redirection - Take users to the default Google Sign in Screen.....

 

In User and Browser Settings you need to have

 

Single sign-on IdP redirection - Allow users to go directly to the SAML IdP Page

 

Now for the important bit..... (this will pass the username entered at the initial Google Page to the Azure AD Page)

 

in Device Settings

 

Autofill Username on SAML ldP page - URL Parameter Name - set this to login_hint

 

I've managed to get all of the settings in place including auto filling the domain on the Google side but the login_hint part for me doesn't seem to work at all. is this still working for you?

 

I'm just wondering if i've missed something somewhere.

[steveg]

I had this working perfectly following the instructions on a test chromebook, started deploying our first set this week and it doesn't do it anymore! Not sure if I've changed a setting or if something else has changed.

[Martman]

So, after loads of time and trial and error ive finally got it passing the username from the initial page to the Azure AD logon page.....

 

In Device Setting you need to have

 

Single sign-on IdP redirection - Take users to the default Google Sign in Screen.....

 

In User and Browser Settings you need to have

 

Single sign-on IdP redirection - Allow users to go directly to the SAML IdP Page

 

Now for the important bit..... (this will pass the username entered at the initial Google Page to the Azure AD Page)

 

in Device Settings

 

Autofill Username on SAML ldP page - URL Parameter Name - set this to login_hint

 

I can't see the 'Single sign-on IdP redirection' option in the User and Browser Settings, it seems to just be a device setting? so the only option seems to be to change the same setting twice. have I missed something?

[snagrat]

I had this working perfectly following the instructions on a test chromebook, started deploying our first set this week and it doesn't do it anymore! Not sure if I've changed a setting or if something else has changed.

 

Did you figure this out?

 

We actually have it working but just introduced a new set of Chromebooks and the username is now not passed to the Azure login

[steveg]

Did you figure this out?

 

We actually have it working but just introduced a new set of Chromebooks and the username is now not passed to the Azure login

 

It just started working again, it seems that sometimes things change at google's end that affect things for a few days - we still sometimes randomly get the login loop problem, which then seems to go away again. It's very frustrating at times!

 

Happy to compare any settings if you want to confirm what yours are set to.

[StephenPink]

Resurrecting this! Anyone figured this out for non-Chrome devices?

Cheers

[robk]

On 16/04/2025 at 11:42, StephenPink said:

Resurrecting this! Anyone figured this out for non-Chrome devices?

Cheers

@StephenPink Can you elaborate on what you want to do?

[EssentialRug]

On 18/04/2025 at 16:34, robk said:

@StephenPink Can you elaborate on what you want to do?

 

I think same as what I was after. Have the Azure login page autofill the domain from Google. Currently when users try to login to a Chromebook they input their email address in the login page, and then they are passed to the Azure credential provider but this is blank and must be filled in again with the users email address. A PITA as users have to input their email address twice. Even populating just the domain here would be useful...

[snagrat]

4 minutes ago, EssentialRug said:

 

I think same as what I was after. Have the Azure login page autofill the domain from Google. Currently when users try to login to a Chromebook they input their email address in the login page, and then they are passed to the Azure credential provider but this is blank and must be filled in again with the users email address. A PITA as users have to input their email address twice. Even populating just the domain here would be useful...

With the login_hint bit you don't get this anymore. They only need to add their email once (prefilled by Google) and then their password

[EssentialRug]

2 minutes ago, snagrat said:

With the login_hint bit you don't get this anymore. They only need to add their email once (prefilled by Google) and then their password

Apologies...confused myself. I meant if doing this on a non Chrome device (say a user is attempting to log into Google Calendar), they will be asked first to input into the Google Credential Provider, and then passed to Azure where they need to enter it again.

[StephenPink]

Yes exactly the same as @EssentialRug  I think!

On non-Chrome devices we want;

- enter full email address

- get redirected to Microsoft login - WITH email pre-filled

- then password/MFA etc

 

However I sort of did get a bit of answer - if you switch to the BETA Microsoft OIDC profile, this does accomplish that - annoyingly it broke some of our internal applications that auth directly to Google. But in the future maybe that's the way to go... 

Otherwise, using the SAML profile I have not been able to find anyway to improve the user experience - neither Microsoft or Google seem to allow you to customise it.

Cheers