Removal of third party idp redirection

Question

Removal of third party idp redirection

Glen Scaglione 21

Hi,

We currently use an F5 BigIP Appliance to perform idp authentication to Azure AD and wish to retire the product. Unfortunately, this was setup close to 6 years ago and all work to configure SSO integration was completed through PowerShell.

Is there a simple way that we can disable this SAML integration (Powershell or via GUI) and revert to Azure AD being our IDP?

Glen

James Hamil 27,221 Reputation points Microsoft Employee Moderator

2021-01-04T22:48:50.517+00:00

Hi @Glen Scaglione , I'm not familiar with F5, is that just used for authentication? Where are you storing your users? Do you have an on-prem AD or have you been using Azure? If you could, please give me an overview of your environment and I can see what options are best for you!

Thank you,
James
Glen Scaglione 21 Reputation points

2021-01-04T23:15:12.203+00:00
Hi @James Hamil ,

Users are both in AD and in Azure-AD. We are using AD Connect to replicate changes across to Azure AD and use the F5 as a SAML 2.0 Proxy/ Gateway for authentication requests to 365 Resources. The process allowed us at the time to be able to then perform MFA requests using Cisco DUO. In short:

A user will make a request to an O365 resource.

The authentication request is forwarded back to the F5 appliance.

The F5 uses conditional rules to determine where the user is located. If in a trusted network, the authentication request is passed through. If in an untrusted location, an MFA challenge using DUO is presented to the end user.

If challenge is presented and passed, O365 resource is accessible, else denied.

Regards,

Glen Scaglione
Glen Scaglione 21 Reputation points

2021-01-04T23:16:21.843+00:00

As a note @James Hamil ,

This service was introduced close to 5 years ago and we are looking to move all authentication and access mechanisms back to Azure AD and retire the F5 appliance, as Azure AD now performs the same roles as the F5 appliance and the F5 appliance is end of support.

Glen
James Hamil 27,221 Reputation points Microsoft Employee Moderator

2021-01-06T00:21:12.007+00:00

Hi @Glen Scaglione , thanks for the reply, I understand much better now. What have you tried so far, and are you stuck on anything?
Glen Scaglione 21 Reputation points

2021-01-06T04:54:11.67+00:00

Hi @James Hamil ,

I have looked at the External Identities within Azure AD GUI and the SAML Identity is not there. Additionally, when using the PowerShell script Get-AzureADExternalDomainFederation to list all of the External Federations, there is no federated sites listed.

Is there any other way to check where the device is attaching to Azure AD?

Regards,

Glen Scaglione

Accepted answer

0 additional answers

Your answer

James Hamil 27,221 Reputation points Microsoft Employee Moderator

2021-01-04T22:48:50.517+00:00

Hi @Glen Scaglione , I'm not familiar with F5, is that just used for authentication? Where are you storing your users? Do you have an on-prem AD or have you been using Azure? If you could, please give me an overview of your environment and I can see what options are best for you!

Thank you,
James
Glen Scaglione 21 Reputation points

2021-01-04T23:15:12.203+00:00

Hi @James Hamil ,

Users are both in AD and in Azure-AD. We are using AD Connect to replicate changes across to Azure AD and use the F5 as a SAML 2.0 Proxy/ Gateway for authentication requests to 365 Resources. The process allowed us at the time to be able to then perform MFA requests using Cisco DUO. In short:

A user will make a request to an O365 resource.

The authentication request is forwarded back to the F5 appliance.

The F5 uses conditional rules to determine where the user is located. If in a trusted network, the authentication request is passed through. If in an untrusted location, an MFA challenge using DUO is presented to the end user.

If challenge is presented and passed, O365 resource is accessible, else denied.

Regards,

Glen Scaglione
Glen Scaglione 21 Reputation points

2021-01-04T23:16:21.843+00:00

As a note @James Hamil ,

This service was introduced close to 5 years ago and we are looking to move all authentication and access mechanisms back to Azure AD and retire the F5 appliance, as Azure AD now performs the same roles as the F5 appliance and the F5 appliance is end of support.

Glen
James Hamil 27,221 Reputation points Microsoft Employee Moderator

2021-01-06T00:21:12.007+00:00

Hi @Glen Scaglione , thanks for the reply, I understand much better now. What have you tried so far, and are you stuck on anything?
Glen Scaglione 21 Reputation points

2021-01-06T04:54:11.67+00:00

Hi @James Hamil ,

I have looked at the External Identities within Azure AD GUI and the SAML Identity is not there. Additionally, when using the PowerShell script Get-AzureADExternalDomainFederation to list all of the External Federations, there is no federated sites listed.

Is there any other way to check where the device is attaching to Azure AD?

Regards,

Glen Scaglione

Answer 1

James Hamil 27,221 Microsoft Employee Moderator

Hi @Glen Scaglione , you can remove the external idp from the Portal or via Powershell using the instructions here. If this doesn't work, run Set-MsolDomainAuthentication -Authentication Managed. I hope this helps! If so, please mark this answer as verified. Please let me know if I can help with anything else.

Best,
James

Glen Scaglione 21 Reputation points

2021-01-06T05:53:20.417+00:00

Hi @James Hamil ,

This information did not work in my scenario.... however, running the traditional Set-MsolDomainAuthentication -Authentication Managed, this removes the association.

Thanks for all of your help.

Regards,

Glen Scaglione
James Hamil 27,221 Reputation points Microsoft Employee Moderator

2021-01-07T21:01:48.277+00:00

Hi @Glen Scaglione , thank you for replying with the fix. I edited my original answer with your solution. If you wouldn't mind, please verify the answer so other users can use it as reference.

Thank you,
James

Share via

Removal of third party idp redirection

0 additional answers

Your answer