> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Integrate Microsoft Entra ID with Identity as a Service

This page describes how to integrate [Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/whatis) with Identity as a Service. There are two ways to do this:

1. Create an Entra ID Cloud to Cloud Directory. See [Configure a Microsoft Entra ID](/docs/directories-and-provisioning/manage-directories/configure-microsoft-entra-id.md). This is an easier method.
2. Follow the directions in this integration to create a Microsoft Entra ID LDAP directory.

## Integrate an Microsoft Entra ID AD LDAP directory

Before you begin, ensure that you complete the following prerequisites:

- [Create groups and assign users to groups in Microsoft Entra ID](/docs/people-and-access/manage-members/create-and-manage-groups.md)
- [Create ImmutableID 0365 attribute](/docs/people-and-access/manage-members/create-and-manage-user-attributes.md)
- [Create and configure a Gateway](/docs/gateways/create-and-configure-a-gateway.md)

## Finish integrating Microsoft Entra ID with Identity as a Service

To enable Microsoft Entra ID users to perform SSO to Office 365 applications, you need to set the ImmutableID for each user. If your Office 365 application is already configured, you need to unfederate it before setting the ImmutableID for each user. Follow these procedures in [Integrate Microsoft Office 365 with Identity as a Service](/docs/applications-and-sso/saml-integration-guides/integrate-office-365.md).

### Step 6: Prepare users for Microsoft Office 365 access

#### Add users for Microsoft Office 365 access

This procedure describes how to add user accounts on Microsoft Office 365 and Identity as a Service so that single sign-on (SSO) attempts from Microsoft Office 365 to Identity as a Service are successful. You can add users as follows:

- Add users one at a time
- Add users through external directory synchronization
- Add users using PowerShell

ATTENTION

To simplify configuring Active Sync on a mobile device, when creating new users, ensure that the user name is the same as the Identity as a Service User ID. For example, if the User ID in Identity as a Service is agrey assign the user name <agrey@mycompany.com> to the new user in Microsoft Office 365.

1. Create users for Microsoft Office 365 using one of the following methods.

   1. Create users one at a time.

      To add users individually to your Microsoft Office 365 account, see [Add users individually or in bulk to Microsoft Office 365 - Admin Help](https://docs.microsoft.com/en-us/office365/admin/add-users/add-users?redirectSourcePath=%2fen-us%2farticle%2fAdd-users-individually-or-in-bulk-to-Office-365-Admin-Help-1970f7d6-03b5-442f-b385-5880b9c256ec&view=o365-worldwide) for instructions.

   2. Create users using external Directory Synchronization.

      If you are using external Directory Synchronization tools such as AD Connect to create users in Microsoft Office 365, the user's on-premise directory objectGUID is synchronized as the Microsoft Office 365 ImmutableID and then skip to Step 3.

   note
   In cases where your user moves directory forests, the ObjectID will change but the ImmutableID will not. In such cases, you need to manually modify the ImmutableID as described in [Understand and Modify Microsoft Office 365 users ImmutableID](https://msexperttalk.com/understand-and-modify-office365-users-immutableid/) or [Reconnecting Cloud Users with Old/Previous/Moved AD User Objects](https://msryanph.wordpress.com/category/office-365/dirsync/).

   3. Create users using Powershell.

      There are two ways to create users in PowerShell: manually (one-by-one) or bulk importing user profiles using a CSV file.

      **Manually creating users in PowerShell**

      To create a user using PowerShell, open PowerShell and enter a command containing the correct **LicenseAssignment** value. To get the License Assessment value, enter:

      ```powershell
      Get-MsolAccountSku
      ```

      Once identified, enter the following to create a new user:

      ```powershell
      New-MsolUser -DisplayName "<Name>" -FirstName "<First name>" -LastName "<LastName>" -UserPrincipalName <name>@<domain> -ImmutableID <character string> -UsageLocation <Location initials> -LicenseAssignment <License Agreement value>
      ```

      You can enter any value for `<character string>`.

      The same command structure for creating a user can be used to create a PowerShell script.

   4. Bulk importing user profiles using a CSV file

      Follow the steps in described in [Create user accounts with Microsoft Office 365 PowerShell](https://docs.microsoft.com/en-us/office365/enterprise/powershell/create-user-accounts-with-office-365-powershell). Be sure to include the ImmutableID parameter when creating the users.

2. Verify that your users have been created by reviewing your list of users in the Microsoft Office 365 UI.

3. Return to the PowerShell command line interface. Enter the following to get the UserPrincipalName and ImmutableID values:

   ```powershell
   Get-MsolUser | Select-Object UserPrincipalName, ImmutableID
   ```

4. Create an Immutable ID for each user that does not have one by entering

   ```powershell
   Set-Msoluser -UserPrincipalName <user@tenantname.onmicrosoft.com> -ImmutableID <character string>
   ```

   You can enter any value for `<character string>`

info
If you have synced with On-premises AD, replace `-ImmutableID <character string>` with the Identity as a Service user profile ImmutableID value. For example, `-ImmutableID +FELF0aANBcvfWMLSD=`.

To find the user's ImmutableID, on Identity as a Service, go to **Members > Users** to display the Users List page. Click the user to view the user profile and scroll to **Optional Attributes**.

For more information, see [Map ImmutableID to directory objectGUID](/docs/directories-and-provisioning/manage-directories/map-immutableid-attribute-to-the-directory-attribute.md).

5. Leave the list of user credentials that appear in PowerShell open.

6. Log in to your Identity as a Service account.

7. Add the users that you created for your Microsoft Office 365 account on Identity as a Service. You can do this through [Active Directory Synchronization](/docs/directories-and-provisioning/manage-directories.md), [Bulk Import](/docs/perform-bulk-operations/bulk-import-operations/import-users.md), or [adding users](/docs/people-and-access/manage-members/add-users-to-identity-as-a-service/add-users.md) individually.

8. Enter the ImmutableIDs and User Principal Name values listed in PowerShell into the Identity as a Service O365 ImmutableID and User Principal Name attribute fields. To do this:

   1. Click Menu icon **>** **Members > Users**. The **Users List** page appears.
   2. Click the **User ID** for the profile you want to edit. The **User Profile** page appears.
   3. Under **Attributes**, do the following:
   4. Locate the attribute you created for the O365 ImmutableID and on the line below it, enter the O365 ImmutableID from PowerShell.
   5. Locate the attribute for the User Principal Name and on the line below it, enter the User Principal Name from PowerShell.
   6. Click **Save**.

### Step 7: Configure Microsoft Office for Identity as a Service using PowerShell

1. Open PowerShell.

2. Enter `Connect-MsolService.`

3. Enter your user name and password in the prompt, for example, `admin@<domain>.onmicrosoft.com`

4. Ensure that the domain to be federated with Identity as a Service is not the default domain in Microsoft Office. (The default domain in Microsoft Office cannot be federated through SAML authentication).

   If your domain has not previously been federated with an IDP, including Identity as a Service or (Active Directory Federation Services) (AD FS), you can skip to step 6.

5. If you have already added a Federated Domain and it is federated with an IDP, including Identity as a Service or AD FS, you must break the existing federation by following these steps:

tip
If you are not using AD FS you can skip steps b-d in this step.

1.   Verify which domains are federated by entering `Get-MsolDomain`.

2.   Set your credentials to connect to Office 365 and the AD FS server: `Set-MsolADFSContext -Computer <ADFS SERVER>`

3.   Convert the domain to standard (as opposed to federated).

4.   Enter `Convert-MsolDomainToStandard -DomainName <domain to convert> -SkipUserConversion:$true -PasswordFile C:\userpasswords.txt.`

    note

          The password text file can be given any name.

5. Set authentication to be managed by Microsoft Office 365: `Set-MsolDomainAuthentication -Authentication Managed -DomainName <domain to convert>`.

6. Enter each of the following variables in PowerShell:

   ```powershell
   $domain="<Microsoft Office 365 domain>"
   $issuer="<EntityID>"
   ```

note
Open the metadata file you downloaded in _**Step 5: Download the Metadata file from Identity as a Service**_ and locate the value for the EntityID.

```powershell
$logon="https://<Identity as a Service_Domain>/api/saml/SAML2/SSO"
$logoff="https://<Identity as a Service_Domain>/logout.html"
```

note
Where Identity as a Service_Domain is the domain of your custom Identity as a Service account URL.

```powershell
$cert="<ds:X509Certificate>"
```

Attention
If you are updating the certificate, ensure that the new certificate is set correctly.

note
Open the metadata file you downloaded in **Configure Identity as a Service for Microsoft Office 365** access and locate the value for `ds:X509Certificate`. You must copy the entire value

If you enabled ActiveSync in **Step 3: Add Microsoft Office 365** to Identity as a Service, enter the following:

```powershell
$activeLogOnUri="<Active Logon URI>"

    # If you did not set ActiveSync, set the value as follows:

    $activeLogOnUri=$logon
```

7. Enter the following:

   ```powershell
   Set-MsolDomainAuthentication -DomainName $domain -FederationBrandName $domain -Authentication Federated -PassiveLogOnUri $logon -ActiveLogOnUri $activeLogOnUri -IssuerUri $issuer -LogOffUri $logoff -PreferredAuthenticationProtocol SAMLP -SigningCertificate $cert
   ```

   If the operation is successful, PowerShell does not return a response in the command line. If you receive an error, double check the format and syntax of your commands.

## Next steps

Once you finish the prerequisites, complete the following procedures:

- [Configure Microsoft Entra ID to support LDAP](/docs/directories-and-provisioning/manage-directories/integrate-microsoft-entra-id-with-identity-as-a-service/configure-microsoft-entra-id-to-support-ldap.md)
- [Synchronize Microsoft Entra ID External users with IDaaS](/docs/directories-and-provisioning/manage-directories/integrate-microsoft-entra-id-with-identity-as-a-service/synchronize-microsoft-entra-id-users-with-idaas.md)
- [Block Microsoft Entra ID users](/docs/directories-and-provisioning/manage-directories/integrate-microsoft-entra-id-with-identity-as-a-service/block-microsoft-entra-id-users.md)
- [Sync an on-premise AD with Microsoft Entra ID](/docs/directories-and-provisioning/manage-directories/integrate-microsoft-entra-id-with-identity-as-a-service/sync-an-on-premise-ad-with-microsoft-entra-id.md)