This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(92.8, 62%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJD%3C/text%3E%3C/svg%3E)
Hello everyone,
I added Salesforce (as an example) to azure AD and I federated it (it works). I also added Workspace one access as another idp into Azure AD. I want my users they authenticate with Workspace One access idp instead of Azure AD. Is it possible to redirect the authentication? I didn't find any rules for that.
Thank you very much for your help.
Regards
Julian
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(246.4, 20%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESM%3C/text%3E%3C/svg%3E)
Hi @julien deroche ,
Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Hi @julien deroche ,
Thanks for reaching out.
Yes, it is possible to redirect the authentication to Workspace One access IDP instead of Azure AD. You can achieve this by configuring the Home Realm Discovery (HRD) policy in Azure AD. HRD policy is used to determine which identity provider (IDP) should be used to authenticate a user based on the user's email domain.
Once users enter their UPN, if they belong to a federated domain, they will be redirected to the sign-in page of the Identity Provider (IdP) associated with that domain.
Reference : https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/home-realm-discovery-policy
Hope this will help.
Thanks,
Shweta
Please remember to "Accept Answer" if answer helped you.
Hi Shweta Mathur !
Thank you very much for your answer, is it mandatory to federate the domain? I'd like to do this scenario
I didn't see the powershell command for that.
Do I need to set the "AccelerateTo FederatedDomain" to false?
I didn't see in the documentation where we can find which idp we want for this application either.
Thank you in advance for your help
New-AzureADPolicy
-Definition @("{`"HomeRealmDiscoveryPolicy`":{`"AccelerateToFederatedDomain`":true}}") -DisplayName BasicAutoAccelerationPolicy
-Type HomeRealmDiscoveryPolicy
Yes, it is mandatory to federate the domain in order to use HRD policy for auto-acceleration.
You can specify the preferred domain in the HRD policy definition. Here is an example of how to create an HRD policy that auto-accelerates users to a verified domain.
New-AzureADPolicy -Definition @("{`"HomeRealmDiscoveryPolicy`":{`"AccelerateToFederatedDomain`":true, `"PreferredDomain`":`"federated.example.edu`"}}") -DisplayName MultiDomainAutoAccelerationPolicy -Type HomeRealmDiscoveryPolicy
| AccelerateToFederatedDomain | Boolean | Set to true for auto-acceleration (bypass home realm discovery). If true and there's only one verified and federated domain in the tenant, then users are taken straight to the federated identity provider (such as ADFS) for sign in. If true and there's more than one verified domain in the tenant, PreferredDomain must be specified. Optional. |
|---|---|---|
Hope this will help.
Thanks,
Shweta
Please remember to "Accept Answer" if answer helped you.
Hello Shweta,
Thank you for your answer, I had to choose another solution, it's all or nothing and it's not possible for the customer.
Thank you again