Steps / Procedures for configuring Office 365 with OnPremise ADFS 4.0 (2016) to allow SSO passwordless company-wide.

EnterpriseArchitect 5,136 Reputation points
2020-07-09T07:29:57.247+00:00

As I'm using Hybrid Office 365 and Exchange 2013 environment and the OnPremise AD is synced to Azure AD using Azure AD Connect. version 1.4.18.0

I have successfully configured and deployed multiple ADFS 4.0 (2016) in my corporate WAN environment.

What're the steps I can follow to securely configure the Microsoft 365/Azure SSO with my current ADFS farm to allow SSO for all of my users?

The goal here is to allow the user to login to Microsoft 365/Azure services using their current Windows UPN (Email address) login just once secured by 2FA/MFA.

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,222 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,532 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. AmanpreetSingh-MSFT 56,501 Reputation points
    2020-07-09T09:27:50.273+00:00

    Hello @EnterpriseArchitect

    Here is a step-by-step guide for setting up ADFS 2.0 for Office 365 for Single Sign-On. However, the process is same for ADFS 4.0 as well.

    As you have already setup ADFS environment and users are synced to Azure AD, all you need to do is run below commands from the Primary ADFS Server to configure federation between O365 and ADFS.

    Install-Module MSOnline
    Connect-MsolService
    Convert-MsolDomainToFederated –domain < your_domain.com >

    Then configure the ADFS Service Name to local intranet zone on all the client computers in your environment. You can use GPO for this purpose as well. This is required to facilitate WIA (Windows Integrated Authentication) so that existing NTLM or Kerberos tickets can be used for authentication and you will not be prompted for authentication.

    You can refer to this documentation for configuring ADFS to use Azure MFA for 2nd factor authentication.

    For best Seamless SSO experience, I would suggest you to go with hybrid Azure Active Directory join for federated domains


    Please do not forget to "Accept the answer" wherever the information provided helps you. This will help others in the community as well.

    1 person found this answer helpful.