HelloID

Open PowerShell ISE as Administrator.

Copy the following script and fill in the following parameters:

1. $domain

   Replace <custom_azure_domain> with your custom Azure domain.

2. $metadataUri

   Replace <HelloID_application_metadata_uri> with the HelloID application metadata URI.

   # Define domain name to use HelloID as IDP for.
   $domain = "<custom_azure_domain>"
   
   # Define HelloID metadata download URI
   $metadataUri = "<HelloID_application_metadata_uri>"
   
   ###------------------------------ This script will set HelloID as IDP for an Office365 domain ------------------------------###
   function Set-AzureADIdpFederation {
       [CmdletBinding()]
       param(
           [Parameter(Mandatory = $true,
               HelpMessage = "Please enter the Office 365 domain you wish to federate. Example: Enyoi.com",
               ValueFromPipeline = $true,
               ValueFromPipelineByPropertyName = $true)]
           [ValidateNotNullOrEmpty()]
           [String]
           $Domain,
   
           [Parameter(Mandatory = $true,
               HelpMessage = "Please enter the HelloID metadata download URL. Example: https://enyoi.helloid.com/metadata/download?ApplicationGUID=3un12a05-92p3-3210-99fe-3c2tgmd8373f",
               ValueFromPipeline = $true,
               ValueFromPipelineByPropertyName = $true,
               ParameterSetName = "ParseMetadataFile")]
           [ValidateNotNullOrEmpty()]
           [String]
           $MetadataUri
       )
   
       # Install MSOnline PowerShell module, if not already available.
       if (!(Get-Module -ListAvailable -Name MsOnline)) {
           Install-Module MsOnline
       }
   
       # Import MSOnline PowerShell module, if not already imported.
       if (!(Get-Module -Name MsOnline)) {
           Import-Module MsOnline
       }
   
       # Connect to Office365
       #Connect-MsolService
   
       # Get all Office365 domains, provides a list you can choose from
       $o365Domains = get-msoldomain
   
       # If the domain is already federated, it has to be reverted.
       $selectedDomain = $o365Domains | Where-Object { $_.Name -eq $Domain }
   
       if ($selectedDomain.Authentication -eq "Federated") {
           #Set-MSOLDomainAuthentication -Authentication Managed -DomainName $Domain
       }
   
       # Parse Metadata and get required info
       $metadata = Invoke-RestMethod -Method Get -Uri $metadataUri
       $issuerUri = $metadata.EntityDescriptor.entityID
       foreach ($binding in $metadata.EntityDescriptor.IDPSSODescriptor.SingleSignOnService) {
           if ($binding.Binding -eq "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" ) {
               # Not sure if the activeLoginUri is correct like this.
               $activeLogOnUri = $binding.Location
               $passiveLogOnUri = $binding.Location
           }
       }
   
       $logOffUri = ([regex]::split($passiveLogOnUri, '(https:\/\/.*\.helloid\.com)')[1]) + "/Authentication/Signoff"
       $signingCertificate = $metadata.EntityDescriptor.IDPSSODescriptor.KeyDescriptor.KeyInfo.X509Data.X509Certificate
       $federationParameters = @{
           DomainName                      = $Domain
           FederationBrandName             = $Domain
           Authentication                  = "Federated"
           ActiveLogOnUri                  = $activeLogOnUri
           PassiveLogOnUri                 = $passiveLogOnUri
           IssuerUri                       = $issuerUri
           LogOffUri                       = $logOffUri
           SigningCertificate              = $signingCertificate
           PreferredAuthenticationProtocol = "SAMLP"
           SupportsMfa                     = $true
           MetadataExchangeUri             = $metadataUri
       }
   
       Set-MsolDomainAuthentication @federationParameters
   
       # Get an overview of the configured settings
       Get-MsolDomainFederationSettings -DomainName $Domain
   }
   
   # Set the newly configured HelloID application as the IDP for the Office365 domain
   Set-AzureADIdpFederation -Domain $domain -MetadataUri $metadataUri

3. Execute the script.

4. A dialog box will ask for the credentials. Enter the credentials of the backup admin account and select the OK button. (The credentials are now available by using the variable $credentials)

   

Go to: https://login.microsoftonline.com and enter a user in the federated domain. The authentication request will be routed to HelloID.

The user will be logged in to Microsoft Azure portal.

Delete the existing certificate in HelloID. See Delete a Certificate.

Create a new self-signed certificate. See Create a New Self-Signed Certificate.

Open PowerShell ISE as Administrator.

Customize and run the following PowerShell code: