New Microsoft OIDC (Beta) SSO profile

[ckutzan]

Hi all!

Happy to be here in our new location!

We have been wanting for a while to configure our Google Workspace to using Azure AD as it's IdP to allow our staff/students to sign in with their M365 accounts (pretty much everything else in our district already uses Azure AD with SSO).

Put it off for quite a while and was preparing to do the ol SAML song and dance but noticed there is now a preconfigured Microsoft OIDC SSO profile option listed (tagged BETA still).  No certs/shared secrets to have to worry about renewing, and for creation just had to approve the Azure AD Enterprise Application it wanted to create and bam seems to be working for a test OU without issues.  

Also on our old forums I remember reading about an issue with SAML SSO setup where users were able to bypass the SSO IdP and login with Google via Chromebooks (bottom right). With OIDC here I don't see that issue either.

Just wondering if anyone else has used/tested this yet and any thoughts or "gotchas" I should be on the lookout for.  

[dochxp]

I have not seen this yet but will be looking into it. We use the 'old' SSO IdP option at the moment. 

[Kim_Nilsson]

Interesting, @ckutzan - So this version of SSO doesn't seem to suffer from that circumvent issue you referred to? Also easier to implement. Sounds like a win-win! 🙂

How much data are you getting over from M/O365? Enough to use as base for dynamic groups and/or OU placement, or will that have to be done solely on the Workspace side?

[ckutzan]

Only delegated permissions this pre-baked OIDC profile requested from Azure AD was:

Perfectly fine for us as our two platforms are already synced via GCDS for OU/users/groups. We just needed SSO.

No issues so far, actually think we are going to apply to our central office users over the summer and maybe roll out divisionally around fall if all goes well.

[dochxp]

It works like a dream!!! 😁