|
The domain being associated with Office 365 must be managed by Office 365 before single sign-on and provisioning can be enabled for your users. Such management requires that the domain not be federated by Active Directory Federation Services (ADFS) or by another IdP service. If your domain is already federated, you must disable federation before you can enable single sign-on for Office 365. Defederation is required for single sign-on, but not for enabling user provisioning into Office 365.
Prerequisites
- Windows PowerShell
- Global Admin credentials for an account that is not within the federated domain
- Start a Windows PowerShell session.
-
If you have not already, install the Microsoft Graph PowerShell Module:
Install-Module Microsoft.Graph
-
Connect to Microsoft Graph with the required scopes:
Connect-MgGraph -Scopes "Domain.ReadWrite.All", "Directory.AccessAsUser.All", "Organization.ReadWrite.All", "Directory.ReadWrite.All"
-
Check the current Domain Authentication type, using the domain you wish to update where indicated:
Get-MgDomain -DomainId your-domain.com | Select-Object Id, AuthenticationType
The AuthenticationType should return Federated.
-
Update the domain to Managed:
Update-MgDomain -DomainId your-domain.com -AuthenticationType Managed
-
Disconnect from Microsoft Graph:
Disconnect-MgGraph
|