Federate our custom domain with an external IdP (Google Workspace SAML)

Question

Federate our custom domain with an external IdP (Google Workspace SAML)

Mark K 0

_We are trying to federate our custom domain (redacted) with an external IdP (Google Workspace SAML). However, our tenant does not allow federation via PowerShell using either MSOnline or AzureAD modules (cmdlet not found or blocked). We need Microsoft to apply domain federation manually via backend to point to our Google IdP using our provided Passive Login URL, Issuer URI, and Signing Certificate.

How do we get this support? I paid for Developer support plan, but was directed to this community rather than a technical support agent who could do this on the backend for us._

1 answer

Your answer

Answer 1

Kancharla Saiteja 4,110 Microsoft External Staff Moderator

Hi @Mark K,

Based on your query, here is my understanding: you would like to make your domain as federated using external IDP.

As per your description, you have tried performing the domain as federated using PowerShell module but failed to do so. In order to achieve the same, you can perform the operation using Microsoft graph as well. Here is the Microsoft document to make your domain as federated: Create samlOrWsFedExternalDomainFederation.

Please make sure you have all the required details like issuerUri, metadataExchangeUri and PassiveSignInUri and other required which needs to make your domain as federated.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly "upvote it". If you have extra questions about this answer, please click "Comment".

Mark K 0 Reputation points

2025-04-29T13:12:32.1133333+00:00
Hi @Kancharla Saiteja

Thank you for your reply and for sharing the Microsoft Graph beta documentation.

I understand that there is a beta endpoint (Create samlOrWsFedExternalDomainFederation) available to attempt domain federation via Microsoft Graph. However, after reviewing the documentation carefully, there are some constraints I would like to clarify:

The Graph API endpoint for federating a domain is currently in beta and not supported for production usage according to Microsoft’s API terms.

The process requires creating a custom app registration, manually configuring advanced Graph API permissions (Domain.ReadWrite.All and Policy.ReadWrite.ExternalIdentities), and scripting a REST API call — all of which introduce operational risk for a straightforward domain federation setup.

For new Entra tenants, there is currently no supported or documented self-service method via Portal or stable PowerShell module for performing federation binding.

Given these constraints, and considering this is a critical foundational configuration for our tenant, I am requesting Microsoft Support’s direct assistance to manually configure federation for the domain using the settings and certificates we have at the ready.

Please confirm if you can escalate this request to backend engineering for manual domain federation setup.

Thank you for your help — looking forward to your confirmation.

Best regards,

Mark
Kancharla Saiteja 4,110 Reputation points Microsoft External Staff Moderator

2025-05-02T21:59:40.0633333+00:00

Hi @Mark K,

Thank you for your response,

I would like to check the issue with you offline. Could you please check your private messages accordingly.
Kancharla Saiteja 4,110 Reputation points Microsoft External Staff Moderator

2025-05-05T08:54:16.13+00:00

Hi @Mark K,

Thank you for your response,

I would like to check the issue with you offline. Could you please check your private messages accordingly.
Kancharla Saiteja 4,110 Reputation points Microsoft External Staff Moderator

2025-05-08T15:59:17.9+00:00

Hi @Mark K,

Could you please check your private messages and respond accordingly.

Share via

Federate our custom domain with an external IdP (Google Workspace SAML)

1 answer

Your answer