As business applications move from on-premises to cloud hosted solutions, users experience password fatigue due to disparate logons for different applications. Single sign-on (SSO) technologies seek to unify identities across systems and reduce the number of different credentials a user has to remember or input to gain access to resources.
While SSO is convenient for users, it presents new security challenges. If a user's primary password is compromised, attackers may be able to gain access to multiple resources. In addition, as sensitive information makes its way to cloud-hosted services it is even more important to secure access by implementing two-factor authentication.
Duo Access Gateway (DAG), our on-premises SSO product, layers Duo's strong authentication and flexible policy engine on top of Office 365 logins using the Security Assertion Markup Language (SAML) 2.0 authentication standard. Duo Access Gateway authenticates your users using existing on-premises or cloud-based directory credentials and prompts for two-factor authentication before permitting access to Office 365.
Duo Access Gateway is part of the Duo Beyond and Duo Access plans, so you can define policies that enforce unique controls for each individual SSO application. For example, you can require that Salesforce users complete two-factor authentication at every login, but only once every seven days when accessing Office 365. Duo checks the user, device, and network against an application's policy before allowing access to the application.
Install Duo Access Gateway on a server in your DMZ. Follow our instructions for deploying the server and configuring DAG settings.
Include the AD attributes mail,sAMAccountName,userPrincipalName,objectGUID in the “Attributes” field when configuring the Active Directory authentication source in the DAG admin console. If you've already configured the attributes list for another cloud service provider, append the additional attributes to the list. You must use Active Directory as your authentication source; other DAG authentication sources do not support Office 365 logins.
After completing the initial DAG configuration steps, click Applications on the left side of the Duo Access Gateway admin console.
Scroll down the Applications page to the Metadata section. This is the information you need to provide to Office 365 when configuring SSO. Click the Download Certificate link to obtain the token signing certificate (the downloaded file is named "dag.crt").
Log in to the Microsoft Office 365 Portal Identity Federation Setup page as the tenant administrator. You'll need to complete most of the ten steps for single sign-on.
Review the Prepare for single sign-on documentation in step 1. You do not need to install AD FS or Shibboleth. The Duo Access Gateway will be your STS for single sign-on. Make note of the UPN requirements for SSO.
Skip step 2: "Plan for and deploy Active Directory Federation Services 2.0". You do not need to deploy AD FS. Duo Access Gateway replaces AD FS in this SSO scenario.
Click the "Install the Windows Azure Active Directory Module for Windows PowerShell" link as instructed in step 3 to obtain the PowerShell module. Install the Azure Active Directory PowerShell module on a computer joined to your AD domain (so, not the DAG server).
Review the prerequisites for Active Directory Synchronization in step 5.
Activate Active Directory synchronization for your domain in step 6.
Deploy the Active Directory synchronization tool as described in step 7 "Install and configure the Directory Sync tool".
Verify successful Active Directory Synchronization (step 8) and activate Office 365 licensing for unlicensed synchronized users (step 9).
Log on to the domain-joined computer where you installed the Microsoft Online Services Sign-in Assistant, the Windows Azure Active Directory Module for Windows PowerShell, and the Directory Sync tool.
Launch the Windows Azure Active Directory Module for Windows PowerShell and enter the
Connect-MsolService command. Enter your Office 365 administrator credentials for the domain you will be configuring for SSO using Duo Access Gateway.
Verify that your Office 365 domain is not currently federated.
PS C:\> get-msoldomain -domain your365domain.com Name Status Authentication ---- ------ -------------- your365domain.com Verified Managed
If your Office 365 domain is using Federated authentication, you need to convert it from Federated to Managed to modify the SSO settings.
Set-MsolDomainAuthentication –DomainName your365domain.com -Authentication Managed
get-msoldomain command again to verify that the Office 365 domain is no longer federated.
Copy the dag.crt file downloaded from the Duo Access Gateway admin console to the domain-joined computer with the Windows Azure Active Directory Module for Windows PowerShell. Make note of the certificate file location.
Gather the federation parameter information.
|Parameter||Description or Value|
|DomainName||The fully qualified Office 365 tenant domain name (FQDN) to update: your365domain.com|
|Authentication||The authentication type of the domain: Federated|
|PassiveLogOnUri||The DAG login URL where web clients are redirected when signing in to Office 365. This is the SSO URL from the DAG Metadata shown in the DAG admin console: https://yourserver.example.com/dag/saml2/idp/SSOService.php|
|SigningCertificate||The DAG's token signing certificate, downloaded from the DAG Applications page: C:\Path\to\dag.crt|
|IssuerUri||The Entity ID URL from the DAG Metadata shown in the DAG admin console: https://yourserver.example.com/dag/saml2/idp/metadata.php|
|LogOffUri||The DAG logout URL where web clients are redirected when signing out of Office 365. This is the Logout URL from the DAG Metadata shown in the DAG admin console: https://yourserver.example.com/dag/saml2/idp/SingleLogoutService.php|
|PreferredAuthenticationProtocol||SAML 2.0: SAMLP|
Set the federation parameters as PowerShell variables.
$dom = "your365domain.com" $fedBrandName = "Duo Security" $url = "https://yourserver.example.com/dag/saml2/idp/SSOService.php" $uri = "https://yourserver.example.com/dag/saml2/idp/metadata.php" $logoutUrl = "https://yourserver.example.com/dag/saml2/idp/SingleLogoutService.php" $cert=New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\Path\to\dag.crt") $certData = [system.convert]::tobase64string($cert.rawdata)
Verify the PowerShell variables set in step 5.
get-variable dom,fedBrandName,url,uri,logoutUrl,cert,certData | fl Name,Value
Convert the Office 365 domain to Federated authentication with the
Set-MsolDomainAuthentication command, using the PowerShell variables for federation set in step 5.
Set-MsolDomainAuthentication –DomainName $dom -Authentication Federated -FederationBrandName $fedBrandName -PassiveLogOnUri $url -IssuerUri $uri -LogOffUri $logoutUrl -PreferredAuthenticationProtocol SAMLP -SigningCertificate $certData
Verify that your Office 365 domain is now federated.
PS C:\> get-msoldomain -domain your365domain.com Name Status Authentication ---- ------ -------------- your365domain.com Verified Federated
Verify your federation settings.
PS C:\> Get-MsolDomainFederationSettings -domain $dom | fl ActiveLogOnUri : http://dummystsurl.microsoftonline.com/dummyurl DefaultInteractiveAuthenticationMethod : FederationBrandName : Duo Security IssuerUri : https://yourserver.example.com/dag/saml2/idp/metadata.php LogOffUri : https://yourserver.example.com/dag/saml2/idp/SingleLogoutService.php MetadataExchangeUri : NextSigningCertificate : OpenIdConnectDiscoveryEndpoint : PassiveLogOnUri : https://yourserver.example.com/dag/saml2/idp/SSOService.php SigningCertificate : MIICX...*snip*... SupportsMfa : False
See the Single Sign-On Roadmap at the Microsoft TechNet site for more information about configuring SSO for Office 365 using SAML 2.0.
Log on to the Duo Admin Panel and navigate to Applications.
Click Protect an Application, locate SAML - Office 365 in the applications list, and click Protect this Application. See Getting Started for help.
Office 365 uses the Mail attribute and Object-GUID attribute when authenticating. We've mapped Mail attribute and Object-GUID attribute to DAG supported authentication source attributes as follows:
|Duo Attribute||Active Directory|
If you are using non-standard Mail or Object-GUID attributes for your authentication source, check the Custom attributes box and enter the name of the AD attributes you wish to use instead.
Click Save Configuration to generate a downloadable configuration file.
You can adjust additional settings for your new SAML application at this time — like changing the application's name from the default value, enabling self-service, or assigning a group policy — or come back and change the application's policies and settings after you finish SSO setup. If you do update any settings, click the Save Changes button when done.
Click the Download your configuration file link to obtain the Office 365 application settings (as a JSON file).
Important: This file contains information that uniquely identifies this application to Duo. Secure this file as you would any other sensitive or password information. Don't share it with unauthorized individuals or email it to anyone under any circumstances!
Return to the Applications page of the DAG admin console session.
Click the Choose File button in the "Add Application" section of the page and locate the Office 365 SAML application JSON file you downloaded from the Duo Admin Panel earlier. Click the Upload button after selecting the JSON configuration file.
The Office 365 SAML application is added.
Navigate to https://login.microsoftonline.com and enter your Office 365 username or email address (with no password). You will be automatically redirected to your Duo Access Gateway sign-in page to complete authentication. Enter your Active Directory username and password on the Duo Access Gateway login page, and approve the prompt for Duo two-factor authentication. You are logged into Office 365.
Congratulations! Your Office 365 users now authenticate using Duo Access Gateway.
Office 2013 and 2016 desktop applications (including Outlook and Lync) can connect to Office 365 after installing the Duo ADFS integration or federating with the Duo Access Gateway only if Modern Authentication is enabled for your Office 365 tenant. Please see the DAG FAQ or ADFS FAQ for details.
When you log in to Office 365 using an Office 2016 or 2013 application, you'll see the DAG or AD FS primary login page within the Office application, followed by the Duo authentication prompt.
Microsoft's Active Directory Federation Services (AD FS) is a popular choice for SSO because it easily integrates with the AD identity store many organizations already have deployed. Duo's support for cloud applications and SSO drops in to an existing AD FS installation to provide secondary authentication after a user passes primary authentication (successful Active Directory logon).
If you don't already have AD federation running the first step is to install and configure Microsoft AD FS in your organization. Microsoft's Deployment Guides for AD FS versions 2.0, 2.1, and 3.0 are available on the TechNet site.
Once your AD FS services are up and running, the second step is to configure the SSO partnership between your AD FS service and the external cloud resource, in this case Office 365. Learn more about configuring Office 365 SSO with AD FS at the AD FS SSO Checklist at TechNet.
After you have successfully configured and tested AD FS SSO login to Office 365 using your AD domain credentials, you can then install the Duo AD FS integration. AD FS protection is included with Duo's paid plans.
With the Duo integration for AD FS installed, users pass primary authentication to the AD FS service as usual. Once primary authentication succeeds, users are forwarded to the Duo service for secondary authentication. After approving logon using one of Duo's authentication methods, the user is fully logged in to Office 365.
Using a third-party SSO provider for cloud application access? Duo partners with leading cloud SSO providers like Okta and OneLogin to secure access with our strong and flexible authentication platform.