Passwordless Deployment

To configure Microsoft 365 to use CloudGen Access as its Identity Provider, you need to federate a Microsoft account domain. To federate is to establish authentication and/or authorization trust of your domain with Microsoft. CloudGen Access will then be used to log into Microsoft 365. Follow the steps below or see Microsoft Entra Connect: Use a SAML 2.0 Identity Provider for Single Sign On - Azure - Microsoft Entra ID to get started.

It is important to have a fallback method for accessing your Microsoft 365 account to prevent getting locked out. (i.e. a login with another domain such as onmicrosoft.com, which generally comes with each Microsoft 365 account.) CloudGen Access will then be used to log into Microsoft 365.
To avoid an endless loop, if you have already created a Microsoft 365 resource, you cannot create a Microsoft open ID Connect resource. Alternatively, if you have already created a Microsoft open ID Connect resource, you cannot add a Microsoft 365 resource.

Before you begin

If an external Identity Provider will be used for authentication in CloudGen Access to log into Microsoft 365, configure one in Identity > Settings > Authentication Protocol (see How to Configure an Identity Provider).

Important: Microsoft OpenID Connect or SAML 2.0 connected to Azure AD / Microsoft Entra ID will not work in combination with having CloudGen Access as an Identity Provider for Microsoft 365. If an external authentication provider has not been configured, the device/user will be authenticated via CloudGen Access against the certificate created during the enrollment.

CloudGen Access server information to use with domain configuration

You will need the SAML configuration information for Single Sign-On (SSO) configuration.

Log in to your CloudGen Access account.
If a Microsoft 365 resource has not been configured yet, create a new resource of the type SaaS with SAML as the SSO type and configure the SSO settings, either with the Metadata URL or manually (see Add Resource).
Go to Access > Resources and click on the configured Microsoft 365 resource. Click View Server Settings under SSO configuration. This will also guide you through the domain federation process.
Click View Server Settings and follow the steps shown in the popup window.

Note / Important:
The CloudGen Access console UI and screenshots may still display legacy Set-MsolDomainAuthentication commands. Because Microsoft has deprecated the MSOnline PowerShell module, do not run those commands directly. Instead, extract the parameter values (such as LogOnUrl, IssuerUri, and signing certificate) from the console and use the Microsoft Graph PowerShell SDK commands shown below.

In Step 4 of the popup window, enter the domain you want to secure with CloudGen Access to generate your specific SAML parameters. Copy or note the parameter values (LogOnUrl, IssuerUri, SignOutUri, and signing certificate) to use in the Microsoft Graph script below.
Click Done.

Federating your domain

Note that federating your domain to authenticate with CloudGen Access will lead to all users part of that domain to be redirected to CloudGen Access to authenticate. If the users are not yet synced into CloudGen Access, then those users will not be able to log into Microsoft 365 after federating the domain; the login is forwarded to CloudGen Access, and if the user does not exist in CloudGen Access, it will not find the user. For testing purposes, it is recommended to set up a test domain in Microsoft Entra ID/ Azure AD and only add test users, and federate this test domain so it will not affect all users. Additionally, note that the default domain (Azure Naming) cannot be federated. The onmicrosoft.com domain needs to be set as the default domain so that the custom domain can be federated.

Open PowerShell in Administrator mode.
Install the Microsoft Graph PowerShell SDK:
Install-Module Microsoft.Graph -Scope CurrentUser
Authenticate with an admin account of your domain using Microsoft Graph:
Connect-MgGraph -Scopes "Domain.ReadWrite.All", "Directory.AccessAsUser.All", "User.ReadWrite.All"
It will prompt you to complete interactive authentication in your browser.
Run the following commands to configure domain federation using Microsoft Graph:
$dom = "test.com" $BrandName = "CGA IDP" $LogOnUrl = "https://api.eu.access.barracuda.com/sso/saml/auth?app_id=xxxxxxxx" $LogOffUrl = "https://api.eu.access.barracuda.com/sso/saml/logout?app_id=xxxxxxxx" $MyURI = "https://api.eu.access.barracuda.com/sso/saml/auth?app_id=xxxxxxxx" $MySigningCert = "mycerthashvalue" $params = @{ ActiveSignInUri = $LogOnUrl DisplayName = $BrandName FederatedIdpMfaBehavior = "acceptIfMfaDoneByFederatedIdp" IssuerUri = $MyURI PassiveSignInUri = $LogOnUrl PreferredAuthenticationProtocol = "saml" SigningCertificate = $MySigningCert SignOutUri = $LogOffUrl } New-MgDomainFederationConfiguration -DomainId $dom -BodyParameter $params

Note: If updating an existing federation configuration, use Update-MgDomainFederationConfiguration instead.

Confirm that the domain is now federated:
Get-MgDomainFederationConfiguration -DomainId $dom
You can also verify the domain's authentication type:
Get-MgDomain -DomainId $dom | Select-Object Id, AuthenticationType
If the authentication type displays Federated, the configuration was successful.
Set the ImmutableID (OnPremisesImmutableId) for your users matching the NameID format that CloudGen Access sends (the email address):
# For a single user: Update-MgUser -UserId "user@test.com" -OnPremisesImmutableId "user@test.com" # For all users on the domain: $users = Get-MgUser -All -Property Id, UserPrincipalName foreach ($user in $users) { Update-MgUser -UserId $user.Id -OnPremisesImmutableId $user.UserPrincipalName }
To confirm the ImmutableID of a user, run:
Get-MgUser -UserId "user@test.com" -Property UserPrincipalName, OnPremisesImmutableId | Select-Object UserPrincipalName, OnPremisesImmutableId
To export all users and their Immutable IDs to a CSV file:
Get-MgUser -All -Property UserPrincipalName, OnPremisesImmutableId, CreatedDateTime | Select-Object UserPrincipalName, OnPremisesImmutableId, CreatedDateTime | Export-Csv -Path "C:\MyFile.csv" -NoTypeInformation