Entra ID SSO with Google as IdP

Question

Hi,

I am configuring for M365 SSO with Google as IdP by following the guide from this Google documentation :

https://apps.google.com/supportwidget/articlehome?hl=en&article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F6363817%3Fhl%3Den&assistant_id=generic-unu&product_context=6363817&product_name=UnuFlow&trigger_context=a

In the Office 365 as SAML Service Provider setup, I run the following script but it always fails.

Here is the powershell script (of course I have adjusted the variable values ​​to the values ​​from Google) I used and the failure information I got.

$dom = "ourDomain.com"
$BrandName = "Whatever you want it to be"
$LogOnUrl = GoogleSSOURL
$LogOffUrl = "https://accounts.google.com/logout"
$ecpUrl = GoogleSSOURL
$MyURI = GoogleEntityID
$MySigningCert = CertFromGoogle
$uri = GoogleEntityID
$Protocol = "SAMLP"

Set-MsolDomainAuthentication
   -DomainName $dom
   -FederationBrandName $BrandName
   -Authentication Federated
   -PassiveLogOnUri $LogOnUrl
   -ActiveLogOnUri $ecpUrl
   -SigningCertificate $MySigningCert
   -IssuerUri $MyURI
   -LogOffUri $LogOffUrl
  -PreferredAuthenticationProtocol $Protocol

Answer 1

Hello @Irvanda,

Thank you for posting your query on Microsoft Q&A.

Based on your description, it appears you are attempting to federate your custom domain with Google IDP. However, when running the Set-MsolDomainAuthentication command, you are encountering the error message:

"Set-MsolDomainAuthentication: Unable to complete this action. Try again later."

This error often occurs when the IssuerUri value is not unique. To resolve this issue, it is recommended to use a unique IssuerUri. You can refer to the following Stack Overflow thread, where a similar issue was resolved by ensuring the IssuerUri was unique: https://stackoverflow.com/questions/57397743/o365-federation-setup-set-msoldomainauthentication-unable-to-complete-actio

To confirm if the IssuerUri is unique, try adding a small modification to the end of the URI in the URL.

If the IssuerUri is confirmed to be unique and the issue persists, I recommend using Microsoft Graph PowerShell commands instead of the MSOL PowerShell command, as the latter is scheduled for deprecation between January 20, 2025, and March 30, 2025.

For more details about this deprecation, refer to this blog post:

https://techcommunity.microsoft.com/blog/identity/action-required-msonline-and-azuread-powershell-retirement---2025-info-and-resou/4364991

You can find documentation for the Microsoft Graph command here:

https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.directorymanagement/update-mgdomainfederationconfiguration?view=graph-powershell-1.0&viewFallbackFrom=graph-powershell-beta

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,
Raja Pothuraju.