Home / server / Questions / 787295
In Process
blsub6
Asked: 2016-07-01 17:21:56 +0800 CST

Office 365 SSO with different internal and external domain names

  • 772

I'm trying to get SSO to work with Office 365 and Sharepoint online and I'm getting really confused. My internal domain is "internal.com" and my external name is "external.com". external.com is added as a domain in O365, but internal.com is not. Should I put internal.com on a external DNS server and add it as a domain in O365? Would that make it so my internal users wouldn't have to sign into external.sharepoint.com?

active-directory single-sign-on microsoft-office-365 adfs azure-active-directory

2 Answers

  1. When you sync with Office 365 your internal domain must be a routable address and this should be assigned to users UPN suffix. When you sync users you will then use the same logon as you would internally ([email protected]) to login to Office 365.

    it's fine to have your Federated endpoint accessible from external.com (i.e. sts.external.com), as the server will be configured to talk to the internal systems. This won't change the name users will use to login.

    • 2

  2. You need to add your external domain (email domain) as an alternate UPN suffix for internal Active Directory users.

    To add UPN suffixes (from TechNet)

    1. Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click Start , click Administrative Tools , and then click Active Directory Domains and Trusts.
    2. In the console tree, right-click Active Directory Domains and Trusts, and then click Properties.
    3. On the UPN Suffixes tab, type an alternative UPN suffix for the forest, and then click Add.
    4. Repeat step 3 to add additional alternative UPN suffixes.

    If you need to update the UPN suffix for existing users, this article on the Office 365 support site has related background info with a handy PowerShell script. You may not be using domain.local, but the concepts all still apply.

    • 2