Cấu hình ADFS 2.0 dùng cho Single Sign On for Office 365

in Office 365. This article takes you through the steps of achieving it.

First, do remember the following points if you are going ahead with Single Sign-On in Office 365.

  • You need to have ADFS 2.0 on one server & Directory Synchronization (Dirsync) on another server in your on premise environment.
  • You need to make sure that ADFS server is ALWAYS up and running. If it crashes, because of any reason, federated users will not be able to Login to Office 365.

Keeping the above points in mind, let me start of by taking an example of a typical SMB environment

Environment Details (each on different server)

  • Domain Controller
  • ADFS 2.0
  • DirSync
  • Exchange 2007 (or 2010)
  • SharePoint 2007 (or 2010)

Step 1 : Add Host record in your public DNS ( such as godaddy.com) for your ADFS 2.0 Server.

Step 2: Install ADFS 2.0 (Find the snapshots below)

  • Download ADFS 2.0 on the ADFS Server
  • Install IIS on ADFS Server
  • Get a Enterprise CA Certificate and bind it to Default web site,port 443, in IIS on ADFS 2.0 server.

NOTE : Register and verification of the domain in Office 365 has to be done before you configure ADFS (not covered in this article)

Snapshots for ADFS installation and configuration


Leave the check mark as it is and this will start the configuration wizard automatically.

Click on ADFS 2.0 Federation Server Configuration Wizard.

Choose New Federation Service as its the first ADFS 2.0 Server in the farm.

New Federation Server Farm : this is used when you have plans of having more than one ADFS server in your environment. With Office 365, I recommend this option as I mentioned earlier in the post if ADFS 2.0 goes down, none of your federated users will be able to login to Office 365. So have more than one ADFS server & providing High Availability using Load balancing is recommended.

Stand-alone federation Server : Used in testing environment or small production environment. Cannot add more than servers to make it a server farm.

Click Next after choosing the appropriate option.

Verify if this stage shows the right certificate , port and federation service name.

On the Summary screen click next and then click finish.

ADFS is now installed and configured.

Step 3: Download Microsoft Online Services Module for Windows PowerShell

  • To download this tool, login to http://portal.microsoftonline.com, Click On Users under Management.
  • At the right top of the screen, you will see “Single sign-on: Manage | Learn more” ,click on Manage
  • Third step will say “Install the Microsoft Online Services Module for Windows PowerShell
  • Download and install it. Installation is very simple.

Step 4: After the tool is installed, run the “Office Desktop Apps” wizard

Click on “Set Up” -> Select the application and then click “I accept”.

The wizard will configure your Rich Clients to work with Office 365. Once the installation is complete you will see the below screen

Almost done!!…

Only thing left is to make the domain federated. To make a domain as federated domain, you will have to first register and verify the domain. (Register and verification of domain in Office 365 has to be done before you configure ADFS)

Assuming that you have done the domain verification, double click on the shortcut of Microsoft Online Services Identity Federation Management Tool in desktop.

Run the following commands

    • $cred = Get-Credential
You will get a prompt to enter credentials. Enter the Admin account of Office 365 (tenant admin account)
    • Set-MSOLContextCredential -MSOLAdminCredentials $cred
  • Add-MSOLFederatedDomain -DomainName <DOMAIN NAME>

    < DOMAIN NAME> = enter your verified domain name which you want to federate.

To verify that your domain is configured successfully, do the following:

  1. Log on to http://portal.microsoftonline.com using your admin credentials.
  2. Click on Domain under Management
  3. Click on the domain that you just federated
  4. Under the Domain Properties, you should see “Domain Type: Single sign-on: This domain is configured for single sign-on

Get the users on cloud using DirSync and start using Office 365 services VIA single sign-on.

Trả lời

Mời bạn điền thông tin vào ô dưới đây hoặc kích vào một biểu tượng để đăng nhập:

WordPress.com Logo

Bạn đang bình luận bằng tài khoản WordPress.com Đăng xuất /  Thay đổi )

Google photo

Bạn đang bình luận bằng tài khoản Google Đăng xuất /  Thay đổi )

Twitter picture

Bạn đang bình luận bằng tài khoản Twitter Đăng xuất /  Thay đổi )

Facebook photo

Bạn đang bình luận bằng tài khoản Facebook Đăng xuất /  Thay đổi )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.