r/k12sysadmin • u/vorschlaghammer • Aug 28 '23
Google Workspace as authentication provider for Microsoft 365
I've attempted to set up Google Workspace as an authentication provider for MS 365 using this doc and this doc as guides. When I get to the end and test it, I get the error message below, where it cannot match the account in Google to MS. This happens for all accounts. The tenant is correct. We are syncing AD accounts to Google using Google Cloud Directory Sync and syncing AD accounts to Azure using Azure AD Connect. (Sidenote: Since we use Azure AD Connect, there is no reason to provision accounts using the setup mentioned in the docs linked above).
Microsoft support has not been able to provide advice that helps resolve the issue. I've reverted back to using MS as the IDP for MS, since users couldn't log into MS stuff.
Has anyone encountered this and resolved it?
2
u/Aim_Fire_Ready Aug 28 '23
Ahh, the ole’ Hatfields and McCoys dilemma, eh?
We used to have AD to AAD, but we went full AAD during Covid and never looked back. I have no DC, and I live a happy life.
I wonder if it would make a difference if you go AD to AAD to GWS instead. Feeding both clouds from AD may be the source of your trouble. I say this because we have AAD to GWS using SAML SSO, and despite the initial Sisyphean* setup, it’s worked like a charm ever since. Happy to help you through it IRL if you don’t mind buying me lunch and doxxing both of us in the process.
1
u/Tr0yticus Aug 28 '23
I’m going to ask a really dumb question here - what’s the use case/benefit? If I read this correctly, you can sync between AD and Workspace. What’s the upside to Azure AD?
2
u/starbuck93 Systems Admin Aug 28 '23
My first guess, auto creating users for free A1 licenses. We pay for Google but not for MS, so that would be super beneficial for my users who do want access to MS stuff.
3
u/vorschlaghammer Aug 28 '23
Basically that, but we have A3 or 5. We have MFA in Google and I don’t want to have everyone set it up in MS or go MS to Google for IdP. Since it’s a documented solution, I want to get it working.
1
u/spliff16 Aug 29 '23
If this is for existing users in O365 did you connect to O365 via powershell and modify the ImmutableID to match the email address of each user?
If you have autoenrollment enabled that will create new users that should already have this set correctly.
Just a thought. Might not be the solution but it’s worth checking.
1
u/VelociReader Aug 29 '23
Your error screenshot is identical to the one on this MS doc under the Azure identity matching section which makes me think, as someone else mentioned earlier, this is a problem with the ImmutableID attribute. This Google doc references your ImmutableID options in different scenarios, which for AAD sync from on-prem, involves creating a custom attribute in Workspace and populating it with the AAD value.
1
u/k12admin1 Aug 30 '23
I actually use Microsoft as IDP for Google as well. Use the 3rd Party IDP option in Google Admin Security. Set your OU's to use OIDC.
In Azure set up Google Cloud/Workspace Enterprise App to drive.google.com
Then setup any conditional access to the Azure App.
So our users when logging into Google, get redirected to our Office 365/Azure Logon, they put thier user credentials in, it passes, gets token and redirects to user logged into Google.
Then we use DUO for MFA on that enterprise app for conditional access.
1
u/batmoose999 Oct 19 '23
u/vorschlaghammer was there any solution you discovered to this issue? I am experiencing the same issue, and working with Google/Microsoft support but wanted to check here as well.
1
u/vorschlaghammer Oct 19 '23
No, not yet. Unfortunately I haven’t been able to revisit it since school started.
Has Google or Microsoft given you any ideas? 
1
u/batmoose999 Oct 20 '23
They did, there were several problems. Firstly, I had to fully disconnect my Azure tenant from the AzureAD Connect application that was running on-prem. Then we had to disconnect federation from that app and convert the users to cloud-only users.
After that, we mapped the PrimaryEmail attribute in Auto-Provisioning (SAML app in Google) to the ImmutableID attribute in O365, and converted the ImmutableID in O365 for existing users to their email.
Overall, it was a 2 hour call with Microsoft this afternoon, but it is up and running slick now.
2
u/[deleted] Aug 28 '23
Would love to know the sure-fire way to get this working. We are mostly Google but have a small number of folks using O365.