Configure Federation between Google Workspace (as an IdP) and Microsoft Entra (as an SP)

I’ve had to set up Federation between Google Workspace, as an Identity Provider (IdP) and Microsoft Entra as a Service Provicer (SP) and each time I’ve looked up how to do it, the commonly available information online is wrong.

Warning!

Before you start any of this, make sure you have a break-glass user in Entra – you want a Global Admin with a username that is not @your-domain-name.com – i.e. you want to have a Global Admin user with a username ending in yourdomain.onmicrosoft.com or in another domain name that’s not federated.

Make sure you can sign in with this user, and you’ve got MFA etc set up. Test it again and double-check it’s working.

Thank me later.

On with the show!

A lot of guides tell you to use older, deprecated or flat out non-working PowerShell commands like Set-MsolDomainAuthentication which is difficult to get working on Windows at the best of times, and flat out impossible to get working in PowerShell on any other platform.

Fortunately, it can all be done with Microsoft Graph in PowerShell.

First upload make sure you have the Microsoft Graph PowerShell module installed. Be aware that this is a pretty huge module, so if you’re installing it for the first time, it can take a while. You can also install just the submodules you want, but it’ll probably be easier to just install the entire thing.

Install-Module Microsoft.Graph -Scope CurrentUser
Import-Module Microsoft.Graph

Next up, sign into the Google Workspace Admin Console as a Super Admin.

1. Go to Apps > Web and mobile apps

2. Select Add app > Search for apps and search for Microsoft 365

3. On the Google Identity Provider details page, select the option to Download Metadata and take note of the location where the XML file GoogleIDPMetadata.xml is downloaded to.

4. On the Service provider detail’s page:

   • Select the option Signed response
   • Verify that the Name ID format is set to PERSISTENT
   • If you will be using Google autoprovisioning, select Basic Information > Primary email You’ll need to make sure that the OnPremisesImmutableID is set to the email address for every user account currently in Entra.
   • Select Continue

5. On the Attribute mapping page, ensure that Basic Information: Primary Email is mapped to App attributes: IDPEmail

6. Click on Finish.

Next, enable the app for all users.

Select the app, go to User access and Select ON for everyone and then hit Save

Configure Microsoft Entra ID as the Service Provider (SP)

Here’s where we drop into PowerShell and pick up the details from the GoogleIDPMetadata.xml file that you downloaded earlier.

Run these commands in PowerShell from the same folder that you downloaded the XML file to.

Connect-MGGraph -Scopes "User.ReadWrite.All", "Domain.ReadWrite.All", "Directory.AccessAsUser.All"

$domainId = "<your domain name>"

$xml = [Xml](Get-Content GoogleIDPMetadata.xml)

$cert = -join $xml.EntityDescriptor.IDPSSODescriptor.KeyDescriptor.KeyInfo.X509Data.X509Certificate.Split()
$issuerUri = $xml.EntityDescriptor.entityID
$signinUri = $xml.EntityDescriptor.IDPSSODescriptor.SingleSignOnService | ? { $_.Binding.Contains('Redirect') } | % { $_.Location }
$signoutUri = "https://accounts.google.com/logout"
$displayName = "Google Workspace Identity"
Connect-MGGraph -Scopes "Domain.ReadWrite.All", "Directory.AccessAsUser.All"

$domainAuthParams = @{
  DomainId = $domainId
  IssuerUri = $issuerUri
  DisplayName = $displayName
  ActiveSignInUri = $signinUri
  PassiveSignInUri = $signinUri
  SignOutUri = $signoutUri
  SigningCertificate = $cert
  PreferredAuthenticationProtocol = "saml"
  federatedIdpMfaBehavior = "acceptIfMfaDoneByFederatedIdp"
}

New-MgDomainFederationConfiguration @domainAuthParams

To check that the configuration has landed, type in:

Get-MgDomainFederationConfiguration -DomainId $domainId |fl

You’ll see something like this:

ActiveSignInUri                       : https://accounts.google.com/o/saml2/idp?idpid=<GUID>
DisplayName                           : Google Workspace Identity
FederatedIdpMfaBehavior               : acceptIfMfaDoneByFederatedIdp
Id                                    : 3f600dce-ab37-4798-9341-ffd34b147f70
IsSignedAuthenticationRequestRequired :
IssuerUri                             : https://accounts.google.com/o/saml2?idpid=<GUID>
MetadataExchangeUri                   :
NextSigningCertificate                :
PassiveSignInUri                      : https://accounts.google.com/o/saml2/idp?idpid=<GUID>
PreferredAuthenticationProtocol       : saml
PromptLoginBehavior                   :
SignOutUri                            : https://accounts.google.com/logout
SigningCertificate                    : <BASE64 encoded certificate>
AdditionalProperties                  : {}

Once you’re sure that it’s all looking like it should, turn it on.

Update-MgDomain -DomainId "outerspace.co" -AuthenticationType "Federated"

You can then test sign-in using an existing user in Entra that matches a user in Microsoft 365.