AWS SSO Issue with Office 365
Hello,
Heres our setup. AWS SSO configured with office 365. No AD/on prem solution. Pure cloud.
I have configured Office 365 as per AWS configuration instruction(after you create the office 365 app in AWS SSO)
Issue -1
1/ User starts with https://ourdomain.awsapps.com/start
2/ User signs in with their AWS SSO credentials.
3/ Clicks on office 365 apps icon.
4/ Gets the error "AADSTS51004: The user account T23/ImJYakmyYc7bbVJWsw== does not exist in the b450a30a-23d0-4cb5-9105-e3b4f5ef1493 directory. To sign into this application, the account must be added to the directory."
Issue -2
1/ User starts with https://portal.office.com
2/ Enters the username.
3/ Goes to AWS for authentication.
4/ Goes back to portal.office.com page.
5/ Looks between #3 and #4.
The user is present in both office 365 and AWS SSO. Both have same user name. I don't see any ImmutableId for the user in office 365.
Appreciate any help.
Thank you
Closing the loop here, I hope this helps anyone who may be in similar situation.
1/ We have to configure Immutable ID on both side - AWS as well as O365. This is not auto generated hence this needs to be done manually.
2/ On the AWS SSO O365 App, select the Attribute mappings tab and change mapping of the Subject attribute from ${user:ad_guid} to ${user:adImmutableId. This was provided by AWS Support.
Making these changes should make O365 work with AWS SSO.
Relevant questions
In Appstream, Windows server 2019 base image is available with Office 365 ?
Accepted Answerasked a month agoAWS SSO with Microsoft AD as IdP
asked 5 months agoIs there a way to force load earlier versions of Office Apps in AppStream Image Builder
Accepted Answerasked 2 months agoStandalone Microsoft Office on EC2
Accepted Answerasked 2 years agoUnable to register a Grafana new Workspace. Network Failure trying to setup AWS SSO as authentication method.
asked 2 months agoAWS SSO Issue with Office 365
asked 3 years agosend AWS SSO username as a attribute in SAML assertion
asked 2 years agoUsing SES as an SMTP relay with Office365
Accepted Answerasked 2 years agoAWS Managed AD - Add office 365 Administrative Template
asked 3 years agoAWS SSO with GSuite external identify with AWS VPN Client Endpoint
asked a year ago