Lab 06: Add a federated identity provider

Lab scenario

Your company works with many vendors and, on occasion, you need to add some vendor accounts to your directory as a guest and allow them to use their Google account to sign-in.

Estimated time: 25 minutes

Exercise 1 - Configure identity providers

Task 1 - Configure Google to be used as an identity provider

Important Note - For this exercise, you will need a Gmail account on Google. Create a new Google account and then follow the steps for the exercise. Be sure to note the email address and password, they are necessary to complete the lab.

Go to the Google APIs at https://console.developers.google.com, and sign in with your Google account. We recommend that you use a shared team Google account.
Accept the terms of service if you’re prompted to do so.

Create a new project:

At the top of the page, select the project menu to open the Select a project page. Choose New Project. Leave the remaining fields with the default settings.
On the New Project page, give the project a name (for example, MyB2BApp), and then select Create.
Open the new project by selecting the link in the Notifications message box or by using the project menu at the top of the page.
In the left menu, select APIs & Services, and then select OAuth consent screen.
Under User Type, select External, and then select Create.
On the OAuth consent screen, under App information, enter an App name, such as Microsoft Entra ID.
Under User support email, select an email address. This should include the email address that you used to log into Google.
Under Authorized domains, select + Add domain, and then add the microsoftonline.com domain.

   microsoftonline.com

Under Developer contact information, enter the email address for the lab account that you used to sign into the portal.
Select Save and continue.
In the left menu, select Credentials.
Select + Create credentials, and then select OAuth client ID.
In the Application type menu, select Web application. Give the application a suitable name, like Microsoft Entra B2B. Under Authorized redirect URIs, add the following URIs:

      https://login.microsoftonline.com

  https://login.microsoftonline.com/te/**tenant ID**/oauth2/authresp
   (where <tenant ID> is your tenant ID)    ```
  https://login.microsoftonline.com/te/**tenant name**.onmicrosoft.com/oauth2/authresp
   (where <tenant name> is your tenant name)    ```

Select Create. Copy your client ID and client secret. You’ll use them when you add the identity provider in the Azure portal.
You can leave your project at a publishing status of Testing.

Task 2 - Add a test user

Select the OAuth consent screen under APIs and Services menu.
In the Test Users* section of the page, choose **+ Add Users.
Enter the gmail account you created (or are using) for this lab.
Select Save

Exercise 2 - Configure Azure to work with an External identity provider

Task 1 - Configure Microsoft Entra ID for Google federation

Sign in to the https://entra.microsoft.com as an admin.
Select Microsoft Entra ID.
Under Identity, select External Identities.
Choose All identity providers from the menu on the left.

Microsoft provides a direct federation for Google as an identity provider. This can be initiated by selecting + Google from the **External Identities

All identity providers** page

After selecting + Google, another page will open with additional information that is required to configure Google as an identity provider.
Enter the Client ID and Client secret you obtained earlier.
Select Save.

This completes the configuration of Google as an identity provider.

Task 2 - Invite you Test User account

If you used an existing Gmail account, remember to delete the account with **External Identities

All identity providers**. You can also return to the Google developer console and delete the project that you created.

Open Microsoft Entra ID.
Go to Users and select All users.
Select + New User.
Choose Invite external user from the dropdown menu.
Enter the information for the gmail account you set up as a test user for the Google App in Exercise 1 Task 2.
Enter a personal message as you want.
Select Invite.

Use an InPrivate browser to log into your gmail account.
Open the Microsoft Invitation on behalf of in the Inbox.
Select the Accept invitation link in the message.
Enter your username and password as requested in the login dialog (if requested). NOTE If the ferderation is working correctly, this is where you will see the first results of your new Google External Identity provider. You will go to the login screen and be able to log in with your gmail credentials. If the federation is not work, or has not been set up, the user would be sent and ACCOUNT VERIFICATION email after the log in, to confirm the account. With the federation, no extra verification is needed.

NOTE If you get an access error 500, wait about 30 seconds and refresh the page. Choose to RESUBMIT. This error is a timing issue only in the lab environment.

Read over the new Permissions requested by: message that you get. This message is coming from your Azure Lab Domain.
Choose Accept.
Once login is complete, you will be sent MyApplications.

Once you have finished the external user invite process of Task 3, you can log directly into Microsoft Online.
Open a new tab in the browser you have open. NOTE if you did not open a new InPrivate browser in Task 3, you should do so for this step.
Enter the following web address:

   login.microsoftonline.com

Select Sign-in options on the dialog.
Choose Sign in to an organization.
Enter your lab tenant domain name in the box and select Next.
Enter the Google email address and password that you created. At this point, you should see your account passed to Google for confirmation; then enter the Microsoft Office portal.