Entra: Login doesnt redirect to Google

Hello!

Our customer’s setup is as follows: they use Google Workspace (GW) as their Identity Provider with a primary domain (let’s call it primary.com) and a secondary domain (secondary.com). GW is integrated with their Microsoft 365 tenant via SAML. They have users with both @primary.com and @secondary.com accounts, and GW is also their productivity suite and email provider.

Our company developed an AI Agent for them that runs inside Teams. To enable this, we purchased Teams Enterprise licenses and assigned them to some users.

Here’s the behavior:

• @primary.com users → When they sign in to Teams, they enter their email, get redirected to Google login, provide credentials, and successfully sign in.
• @secondary.com users → After entering their email, they are not redirected to Google. Instead, they only see a “Choose a way to sign in” prompt with a back button. This happens across all Microsoft 365 sign-in attempts, not just Teams.

From my research, it appears the issue is due to the lack of a Federation Configuration for secondary.com. Since the old MSOLService module is deprecated, I attempted to configure federation using Microsoft Graph in PowerShell.

Here’s the problem:

• When I try to create a new Federation Configuration for secondary.com, I get: “Resource already exists.”
• When I try to retrieve the configuration, I get: “‘federationConfiguration’ does not exist.”
• When I try to delete, the command fails because it requires the InternalDomainFederationId, which can only be retrieved from the configuration that I cannot access.

I’ve since learned that this phantom configuration likely needs to be removed on the backend by Microsoft Support. However, even though I’ve had a ticket open for over a week, they haven’t confirmed whether they can do this. Instead, they’ve just suggested PowerShell commands I’ve already tried.

I also tried deleting secondary.com from the tenant entirely. But I discovered that removing the domain does not remove the backend Federation Configuration. So, when I re-added the domain, the issue persisted.

At this point, I’m stuck. I may be missing something in my approach or using the wrong commands. Ultimately, I just need secondary.com users to be able to sign in to Microsoft 365 the same way as primary.com users.

Below are the commands I’ve used along with the errors I encountered.

This is were they get stuck logging in:

TIA!