{"id":91638,"date":"2023-06-16T21:48:09","date_gmt":"2023-06-17T01:48:09","guid":{"rendered":"https:\/\/jumpcloud.com\/?post_type=support&p=91638"},"modified":"2024-06-25T14:45:58","modified_gmt":"2024-06-25T18:45:58","slug":"sso-with-m365-alternative-manual-service-provider-set-up-method","status":"publish","type":"support","link":"https:\/\/jumpcloud.com\/support\/sso-with-m365-alternative-manual-service-provider-set-up-method","title":{"rendered":"SSO with Microsoft 365 – Alternative Manual Service Provider Set Up Method"},"content":{"rendered":"\n
If you need a more advanced configuration when you set up Single Sign On (SSO) for Microsoft 365 in JumpCloud, you can use the commands provided in this article with the Microsoft Graph PowerShell SDK.<\/p>\n\n\n\n
<\/p><\/div>
Make sure modern authentication is enabled for the Microsoft 365 Tenant. Learn more in Enable Modern Authentication for Microsoft 365<\/a>.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n <\/p><\/div> For more information – see Find your Office 365 Tenant<\/a> <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n $domain=”yourdomain.tld”<\/p>\n<\/div><\/div>\n\n\n\n $idpUrl=”https:\/\/sso.jumpcloud.com\/saml2\/office365″<\/p>\n<\/div><\/div>\n\n\n\n $logoutUrl=\u201dhttps:\/\/console.jumpcloud.com\/userconsole\/\u201d<\/p>\n<\/div><\/div>\n\n\n\n <\/p><\/div> This variable can’t contain —–BEGIN CERTIFICATE—– and —–END CERTIFICATE—– and can’t contain spaces or newlines.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n <\/p><\/div> Export the metadata file from your JumpCloud SSO configuration and copy the certificate string between <\/p>\n\n\n\n <ds:X509Certificate> and <\/ds:X509Certificate><\/kbd><\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n $certificate=”MIIDtTCCAp2gAwIBAgIJAJUpvv+YllN1MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAlVTMRMwEQY\u2026 $issuerUri=”https:\/\/YOUR_DOMAIN.com<\/p>\n<\/div><\/div>\n\n\n\n New-MgDomainFederationConfiguration -DomainId $domain -DisplayName \u201cJumpCloud\u201d -MetadataExchangeUri $metadataUri -IssuerUri $issuerUri -SignOutUri $logoutUrl -PassiveSignInUri $idpUrl -ActiveSignInUri $idpUrl -SigningCertificate $certificate -PreferredAuthenticationProtocol saml -FederatedIdpMfaBehavior \u201cacceptIfMfaDoneByFederatedIdp\u201d | Format-List<\/p>\n<\/div><\/div>\n\n\n\n Disconnect-MGGraph<\/p>\n<\/div><\/div>\n\n\n\n Now that you\u2019ve configured the service provider, read SSO with Microsoft 365\/Entra ID<\/a> to learn how to authorize user access and validate authentication workflows. <\/p>\n\n\n\nRunning the command<\/strong><\/h2>\n\n\n\n
\n
\n
Connect-MGGraph -Scopes “Domain.ReadWrite.All”, “Directory.AccessAsUser.All”, “Organization.ReadWrite.All”, “Directory.ReadWrite.All”<\/p>\n<\/div><\/div>\n\n\n\n\n
\n
\n
\n
\n
TRUNCATED\u2026
wcsC1lArmug\/\/RG+BPp6yT6qhsm4g4wVcxpHWT8cA1py0TQaIQbNnBqNLDbQJl9oJ3PB9eiKEpEWtdtmcQOW3yB1AdxsQBKxtaNT5PypyLqnJ+e8=”<\/p>\n<\/div><\/div>\n\n\n\n\n
\n
\n
Troubleshooting<\/h2>\n\n\n\n