Configure Single Sign-on for Office 365 (2024)

You can enable users to sign on to Office 365 using one of the following methods:

  • Secure Web Authentication (SWA)
  • WS-Federation - automatic
  • WS-Federation - manual

SWA is a single sign-on method developed by Okta. It stores the end user credentials using strong encryption combined with a customer-specific private key. When the end user clicks the app, Okta securely signs them in using the encrypted credentials. See SWA app integrations.

WS-Federation defines mechanisms to transfer identity information using encrypted SOAP messages. It doesn't require a separate password for Office 365. See WS-Fed app integrations.

Before you begin

  • Complete Add Office 365 to Okta.

  • Bring users into Okta: You can import users from a directory such as Active Directory (AD) or an app such as Salesforce. Currently, Okta doesn't support imports that take longer than two hours to complete. Contact Support if you have this type of import. You can also create users directly in Okta. See the following for more information:

    • Manage Active Directory users and groups
    • Import users
    • Add users manually
  • Disable the Microsoft MFA for the Office 365 admin account that you’re using for WS-Federation. If the MFA is enabled, it can break provisioning and single sign-on setups in Okta.
  • If you're integrating an Azure AD tenant that has the Web Sign-in option Enabled in Microsoft Endpoint Manager admin center, ensure that its configuration settings allow your Okta org URL. See the Microsoft Doc for Policy CSP - Authentication.

Start this task

  1. You can use one of the following methods to configure single sign-on for Office 365:

    See Also
    Single Sign-On für die Citrix Workspace-App mit Okta als IdentitätsanbieterConfigure Single Sign-On options | OktaSingle Sign On to SAP Cloud Integration (CPI runtime) from an external Identity ProviderNative SSO: Desktop and Mobile Apps Single Sign-On

    • Configure Single Sign on with Secure Web Authentication
    • Configure Single Sign-on with WS-Federation - automatic method
    • Configure Single Sign-on using WS-Federation - automatic method (Microsoft Graph)
    • Configure Single Sign on with WS-Federation - manual method
    • Configure Single Sign with WS-Federation - manual method (Microsoft Graph)
  2. Once you've configured the single sign on, you need to Test Single Sign-on configuration.

Configure Single Sign on with Secure Web Authentication

You can enable users to sign in to Office 365 using either SWA or WS-Federation. When possible, use WS-Federation because it's more secure than SWA.

  1. Go to Office 365 > Sign on > Settings > Edit.
  2. In Sign on Methods, select Secure Web Authentication.
  3. Select the appropriate option for username and password setup. See Secure Web Authentication.
  4. Map username format as explained in section 3. Test provisioning.
  5. Click Save.

Configure Single Sign on with WS-Federation

There are two ways of configuring WS-Federation: automatic and manually. You can allow Okta to automatically configure WS-Federation or you can manually configure it using the customized PowerShell script provided by Okta. Configuring WS-Federation automatically is recommended because Okta takes care of the back-end procedures.

Configure Single Sign-on with WS-Federation - automatic method

  1. Go to Office 365 > Sign on > Settings > Edit.
  2. In Sign on Methods, select WS-Federation > Automatic.
  3. Enter your Office 365 Administrator Username and Password.
  4. Click Fetch and Select. This displays a list of all Office 365 domains available for federation.
  5. Select domains that you want to federate.
  6. Click Save.

Configure Single Sign-on for Office 365 (2)

Ensure your administrator credentials for the Office 365 aren't in the domain you're federating.

See Also
Single Sign-On for Okta

This locks you out of the Office 365 domain. You won’t be able to authenticate yourself in Microsoft 365 Admin Center as you have to authenticate through Okta, where you're treated as a user, not as an admin. Ensure you're using administrator credentials for an account that is on your default Office 365 domain. The default tenant domain is yourtenant.onmicrosoft.com.

Configure Single Sign-on using WS-Federation - automatic method (Microsoft Graph)

If you enabled the MS Graph federation feature, your navigation is different.

  1. Go to Office 365 > Sign on > Settings > Edit.
  2. In Sign on Methods, select WS-Federation > Automatic.
  3. Click Authenticate with Microsoft Office 365. You're redirected to the Microsoft account login page.
    1. Log into Microsoft as a Global Administrator for your Microsoft tenant.
    2. Read and accept the requested permissions.
  4. Click Fetch and Select. This displays a list of all Office 365 domains available for federation.
  5. Select domains that you want to federate.
  6. Click Save.

Configure Single Sign-on for Office 365 (4)

Ensure your administrator credentials for the Office 365 are NOT in the domain you're federating.

This locks you out of the Office 365 domain. You won’t be able to authenticate yourself in Microsoft 365 Admin Center as you have to authenticate through Okta, where you're treated as a user, not as an admin. Ensure you're using administrator credentials for an account that is on your default Office 365 domain. The default tenant domain is yourtenant.onmicrosoft.com.

Configure Single Sign on with WS-Federation - manual method

  1. Go to Office 365 > Sign on > Settings > Edit.
  2. In Sign on Methods, select WS-Federation > Manual using PowerShell.
  3. Click View Setup Instructions for the PowerShell command customized for your domain.
  4. Copy this command for use in PowerShell.

In PowerShell:

  1. Enter Connect-MsolService.
  2. Enter your Office 365 Global Administrator username and password.
  3. Enter the copied customized PowerShell command.
  4. Ensure that the federation is successful by entering this command:
    5. Get-MsolDomainFederationSettings -DomainName yourdomain.name

Configure Single Sign with WS-Federation - manual method (Microsoft Graph)

If you enabled the MS Graph federation feature, the PowerShell commands are different.

  1. Go to Office 365 > Sign on > Settings > Edit.
  2. In Sign on Methods, select WS-Federation > Manual using PowerShell.
  3. Click View Setup Instructions for the PowerShell command customized for your domain.
  4. Copy this command for use in PowerShell.

In PowerShell:

  1. Enter Connect-MgGraph -Scopes Directory.AccessAsUser.All.
  2. Enter your Office 365 Global Administrator username and password.
  3. Enter the copied customized PowerShell command.
  4. Ensure that the federation is successful by entering this command:
    5. Get-MgDomainFederationConfiguration -DomainId yourdomain.name

Test Single Sign-on configuration

  1. Log into Okta as a test user.
  2. Open Office 365 from the End-User Dashboard.
  3. Ensure that the user is successfully logged in to the Office 365 account.

Next step

Provision users to Office 365

Configure Single Sign-on for Office 365 (2024)
Top Articles
Jejak Karbon "Urban Farming" 6 Kali Lipat Lebih Besar dari Pertanian Konvensional
Growing Strawberries - The Complete How To Guide - Get Busy Gardening
Besoin de codes triche pour Skyrim ? Secrets et puissance ici
Kaputt - Melee Killmove Manager
Latest Posts
Urban Farming: Technik, Geschäftsmodell, Probleme
Growing Strawberries
Article information

Author: Delena Feil

Last Updated:

Views: 5439

Rating: 4.4 / 5 (65 voted)

Reviews: 88% of readers found this page helpful

Author information

Name: Delena Feil

Birthday: 1998-08-29

Address: 747 Lubowitz Run, Sidmouth, HI 90646-5543

Phone: +99513241752844

Job: Design Supervisor

Hobby: Digital arts, Lacemaking, Air sports, Running, Scouting, Shooting, Puzzles

Introduction: My name is Delena Feil, I am a clean, splendid, calm, fancy, jolly, bright, faithful person who loves writing and wants to share my knowledge and understanding with you.