How to configure sso to work with office 365

Posted on 2013-10-17
Medium Priority
Last Modified: 2013-10-29
We have office 365 e3 with roughly 100 users. we recently added a domain to start managing accounts. We would like to setup Federation services and take advantage of single sign on and synchronize AD with office 365.  right now users are using their email addresses to sign on to owa.  Email/login for 365 format is [first name].[first letter of lastname]@domain.com and the internal AD usernames are formatted as [first name][first 2 letters of lastname]@domain.com .  

If we start the synch and configure sso, will having the different username formats cause problems? if so, would it be best to change the username format on AD or 365(without changing the email address)

Any help is greatly appreciated.
Question by:menreeq
  • 3
  • 2

Expert Comment

ID: 39580694
You will run into issues.
The UPNs must match on both sides.
You can change the UPNs in the AD to match what already exists in Office 365.

After that you should be able to synchronize everything without sign on issues.
LVL 46

Accepted Solution

Vasil Michev (MVP) earned 1500 total points
ID: 39581111
Once you start dirsync, it _should_ update the UPNs of the cloud users to match the local ones. In practice, this almost never happens, so you will have to update them in the cloud (fastest way is using PowerShell's Set-MSOLUserPrincipalName cmdlet). It will match them the first time, but then creates a immutableID and things go a bit downhill :)

When you have AD FS up and running, it doesn't really matter what the UPN is. If you setup everything correctly, users will only be prompted once in Outlook (basic auth stuff there). All other Office 365 related services will be accessible with no prompt and the users will not even notice their username. Only if they have to login outside of the domain environment, they will have to provide a username (and this is one of the reasons people keep the UPNs in O365 matching the on-prem ones).

The primary SMTP can be different ofc, no problems there.

Assisted Solution

menreeq earned 0 total points
ID: 39589329
I got in touch with microsoft and we were able to get the AD sync going with no problem.  The only prereqs before synchronizing were that the email field be populated, and that the proxyaddress matched they primary smtp address of the account.  All the accounts synched with no issues, with the exception that now the primary smtp address is now username@domain.onmicrosoft.com instead of just username@domain.com.   I currently mail is being received and sent but I will want to change the primary smtp address soon.

Also, we still have not deployed SSO, right now we only have AD attributes synchronizing.
Easily manage email signatures in Office 365

Managing email signatures in Office 365 can be a challenging task if you don't have the right tool. CodeTwo Email Signatures for Office 365 will help you implement a unified email signature look, no matter what email client is used by users. Test it for free!

LVL 46

Expert Comment

by:Vasil Michev (MVP)
ID: 39590095
Do you have the domain verified with Office 365?  In principle it should 'link' the accounts based on the UPN and/or the primary SMTP. Anyway, you can easily change the primary SMTP in the cloud by using:

Set-Mailbox username -WindowsEmailAddress user@domain.com

This command will work even on synchronized users.

Author Comment

ID: 39599107
Also as a side note, proxyaddress should be have SMTP: in front of it, and SMTP: must be in capitols

Author Closing Comment

ID: 39608129
Answered my own question but this response pointed me in the right direction.

Featured Post

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Microsoft Office Picture Manager was included in Office 2003, 2007, and 2010, but not in Office 2013. Users had hopes that it would be in Office 2016/Office 365, but it is not. Fortunately, the same zero-cost technique that works to install it with …
Migrating Exchange data from one Exchange Server to another server is complicated. Though Exchange administrators can try manual methods to migrate their data from one version of Exchange to another, these manual methods are not that reliable. That…
Migrating to Microsoft Office 365 is becoming increasingly popular for organizations both large and small. If you have made the leap to Microsoft’s cloud platform, you know that you will need to create a corporate email signature for your Office 365…
The video will let you know the exact process to import OST/PST files to the cloud based Office 365 mailboxes. Using Kernel Import PST to Office 365 tool, one can quickly import numerous OST/PST files to Office 365. Besides this, the tool also comes…

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question