Use ºÚÁϺ£½Ç91Èë¿Ú as your Identity Provider (IdP) for Microsoft-dependent users by configuring Web Services Federation (WS-Fed). Although WS-Fed is a Single Sign-On protocol similar to SAML SSO, it provides support for:
- Windows Add Work Account AAD Join (for Office apps or JC MDM)
- Select Office apps (web and clients)
- Windows onboarding Out-of-Box (OOBE) AAD Join
Read this article to learn how to setup WS-Fed.
Prerequisites
- A ºÚÁϺ£½Ç91Èë¿Ú administrator account
- ºÚÁϺ£½Ç91Èë¿Ú SSO Package or higher or SSO à la carte option
- An active and authorized M365 domain
- Imported users must be created with a connected domain to map Immutable ID
- A user with the Global administrator role in M365 and a Microsoft P1 license
Considerations
- When users are federating as part of an OOBE flow, authentication will fail if requiring Device Trust
Adding a new M365 Application
Skip this section if you have already configured SSO with Microsoft 365/Entra ID
- Log in to the ºÚÁϺ£½Ç91Èë¿Ú Admin Portal.
- Navigate to USER AUTHENTICATION > SSO Applications.
- Configure SSO with Microsoft 365/Entra ID and ensure the IdP Entity ID is the name of the domain you want to federate.
- Select the newly created application and copy the application ID from its URL.
To find the application ID, open the application in the ºÚÁϺ£½Ç91Èë¿Ú Admin Portal. If the URL is https://console.jumpcloud.com/#/applications/663a8fb979aa83c58df6081e/details, the application ID is 663a8fb979aa83c58df6081e.
Federating the Domain
- If not installed, install .
- Run Get-MsolDomain to see list of domains (domain will show as managed).
- If necessary, log into your MS Tenant.
- In a new tab, copy and paste the following URL:
https://sso.jumpcloud.com/wsfed/:appID/commands
- Replace :appID with the Application ID copied in the previous section and hit Enter
- Copy the output
- In Powershell, paste the command that was generated and hit Enter.
- If successful, it will take you back to the prompt.
- Verify the domain is federated by rerunning Get-MsolDomain to see list of domains (domain will now show as federated).
Logging into the Federated Domain
- Log in as a user to the ºÚÁϺ£½Ç91Èë¿Ú User Portal.
- Click I understand at the Password Update Notice.
- In the User Portal, select the Microsoft 365 tile and sign in.
- If successful, you will be taken to your M365 portal.