Configuring WS-Fed SSO with Entra ID

RapidIdentity Platform Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

In this configuration, Entra ID uses WS-Fed authentication with RapidIdentity as the IdP.

  1. Configure the RapidIdentity federation partner:
    1. Open the Configuration module from the Dashboard pop-up menu.
    2. Navigate to Security > Identity Providers > Federation Partners.
    3. Download the following WS-Federation RapidIdentity federation partner configuration, and then click Import.
    4. Select the three dots next to the imported federation partner, and then click Edit.
    5. Go to the General tab.
    6. In the Name field, provide a name for the federation partner.
    7. In the Realm ID field, enter urn:federation:MicrosoftOnline.
    8. Go to the Attribute Release - Attributes tab.
    9. Map the immutableID and UPN attributes to their corresponding RapidIdentity attributes.

      Both attributes must match what is present in Entra ID. For example, if the UPN is lskywalker@email.com and the immutableID is 1234 in Azure, those values must match the corresponding RapidIdentity attributes. The following attribute namespaces are required for successful configuration:

      • UPN: http://schemas.xmlsoap.org/claims
      • immutableID: http://schemas.microsoft.com/LiveID/Federation/2008/05
    10. Go to the WS-Trust Configuration tab.
    11. Enable WS-Trust if passwords will be used when logging into Windows devices.

      This setting must be enabled if passwords will be used when logging into Windows devices. This allows for users to successfully authenticate to Windows devices using their RapidIdentity password.

  2. Collect the required values for Entra ID domain federation:
    1. Obtain the RapidIdentity signing certificate in PEM format.

      The signing certificate is available from your RapidIdentity administrator or by navigating to Configuration > Security > Identity Providers > IDP Configuration. This value is used for the -SigningCertificate parameter.

    2. Confirm your RapidIdentity tenant URL.

      This is the base URL of your RapidIdentity instance, for example https://rimodel.example.com.

    3. Confirm your Entra ID domain name.

      This is the domain you are federating, for example example.com. It is used for the -DomainId parameter.

  3. Open PowerShell as an administrator and run the following commands to configure Entra ID domain federation:
    1. Install the Microsoft.Graph module if it is not already installed.
      if (-not (Get-Module -ListAvailable -Name Microsoft.Graph)) {
    Install-Module -Name Microsoft.Graph -Scope CurrentUser -Force
}
    2. Connect to Microsoft Graph using your Entra ID administrator credentials.
      Connect-MgGraph -Scopes "Domain.ReadWrite.All", "Directory.AccessAsUser.All", "Organization.ReadWrite.All", "Directory.ReadWrite.All"

      A browser window will open prompting you to enter administrator credentials for your Entra ID domain.

    3. Run the following command to configure domain federation, replacing each placeholder with the values collected in the previous step.
      New-MgDomainFederationConfiguration -DomainId "DistrictMSTenant" `
    -ActiveSignInUri "https://RapidIdentityTenantURL/idp/profile/wsfed" `
    -DisplayName "RapidIdentity" `
    -IssuerUri "https://RapidIdentityTenantURL/idp" `
    -SignOutUri "https://RapidIdentityTenantURL/idp/logout" `
    -MetadataExchangeUri "https://RapidIdentityTenantURL/idp/profile/wstrust/mex" `
    -PassiveSignInUri "https://RapidIdentityTenantURL/idp/profile/wsfed" `
    -PromptLoginBehavior "nativeSupport" `
    -PreferredAuthenticationProtocol "wsFed" `
    -FederatedIdpMfaBehavior "acceptIfMfaDoneByFederatedIdp" `
    -SigningCertificate "RapidIdentityPEMSigningCertificate"
      Note:

      If an existing federation configuration exists, it must be removed by running the following command before proceeding:

      Update-MgDomain `
    -DomainId "YourO365Domain.com" `
    -AuthenticationType "Managed"
    4. Verify that the federation configuration was applied successfully.
      Get-MgDomainFederationConfiguration -DomainId "DistrictMSTenant" | Format-List *

RapidIdentity is now configured for SSO authentication via Entra ID.

After WS-Fed federation is configured, you can join Windows devices to Entra ID:

  • For new devices, turn on the device and proceed through the Windows setup process.
  • For existing devices, navigate to Windows Settings > Accounts > Access work or school > Connect > Join this Device to Azure Active Directory.

Intune-managed devices that have been joined to Entra ID can use federated web sign-in, which allows the RapidIdentity IdP to be used for Windows logons. This capability enables a seamless login experience for users and supports passwordless workflows.

Web sign-in requires the following on each device:

  • Windows 11, version 22H2 with KB5030310 or later
  • Microsoft Entra ID with Intune joined
  • Internet connectivity