You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/manage-apps/configure-authentication-for-federated-users-portal.md
+53-33Lines changed: 53 additions & 33 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ ms.service: active-directory
8
8
ms.subservice: app-mgmt
9
9
ms.workload: infrastructure-services
10
10
ms.topic: how-to
11
-
ms.date: 01/02/2023
11
+
ms.date: 03/16/2023
12
12
ms.author: jomondi
13
13
ms.reviewer: ludwignick
14
14
ms.custom: seoapril2019, contperf-fy22q2
@@ -33,7 +33,8 @@ For federated users with cloud-enabled credentials, such as SMS sign-in or FIDO
33
33
To configure HRD policy for an application in Azure AD, you need:
34
34
35
35
- An Azure account with an active subscription. If you don't already have one, you can [create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
36
-
- One of the following roles: Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal.
36
+
- One of the following roles: Global Administrator, or owner of the service principal.
37
+
37
38
::: zone pivot="powershell-hrd"
38
39
- The latest Azure AD PowerShell cmdlet preview.
39
40
::: zone-end
@@ -91,13 +92,17 @@ The following policy auto-accelerates users to a federated identity provider sig
To see your new policy and get its **ObjectID**, run the following command:
150
169
151
170
```powershell
@@ -171,7 +190,9 @@ Get-AzureADServicePrincipal
171
190
After you have the **ObjectID** of the service principal of the application for which you want to configure auto-acceleration, run the following command. This command associates the HRD policy that you created in step 1 with the service principal that you located in step 2.
172
191
173
192
```powershell
174
-
Add-AzureADServicePrincipalPolicy -Id <ObjectID of the Service Principal> -RefObjectId <ObjectId of the Policy>
193
+
Add-AzureADServicePrincipalPolicy
194
+
-Id <ObjectID of the Service Principal>
195
+
-RefObjectId <ObjectId of the Policy>
175
196
```
176
197
177
198
You can repeat this command for each service principal to which you want to add the policy.
@@ -225,36 +246,35 @@ Use the previous example to get the **ObjectID** of the policy, and that of the
225
246
226
247
## Configuring policy through Graph Explorer
227
248
228
-
Set the HRD policy using Microsoft Graph. See [homeRealmDiscoveryPolicy](/graph/api/resources/homeRealmDiscoveryPolicy?view=graph-rest-1.0&preserve-view=true) resource type for information on how to create the policy.
229
-
230
249
From the Microsoft Graph explorer window:
231
250
232
-
1. Grant consent to the *Policy.ReadWrite.ApplicationConfiguration* permission.
233
-
1. Use the URL https://graph.microsoft.com/v1.0/policies/homeRealmDiscoveryPolicies
234
-
1. POST the new policy to this URL, or PATCH to https://graph.microsoft.com/v1.0/policies/homeRealmDiscoveryPolicies/{policyID} if overwriting an existing one.
235
-
1. POST or PATCH contents:
236
-
237
-
```json
238
-
{
239
-
"definition": [
240
-
"{\"HomeRealmDiscoveryPolicy\":
241
-
{\"AccelerateToFederatedDomain\":true,
242
-
\"PreferredDomain\":\"federated.example.edu\",
243
-
\"AlternateIdLogin\":{\"Enabled\":true}}}"
244
-
],
245
-
"displayName": "Home Realm Discovery auto acceleration",
246
-
"isOrganizationDefault": true
247
-
}
251
+
1. Sign in with one of the roles listed in the prerequisites section.
252
+
1. Grant consent to the `Policy.ReadWrite.ApplicationConfiguration` permission.
253
+
1. Use the [Home realm discovery policy](/graph/api/resources/homerealmdiscoverypolicy) to create a new policy.
254
+
1. POST the new policy, or PATCH to update an existing policy.
255
+
256
+
```http
257
+
PATCH /policies/homeRealmDiscoveryPolicies/{id}
258
+
{
259
+
"definition": [
260
+
"{\"HomeRealmDiscoveryPolicy\":
261
+
{\"AccelerateToFederatedDomain\":true,
262
+
\"PreferredDomain\":\"federated.example.edu\",
263
+
\"AlternateIdLogin\":{\"Enabled\":true}}}"
264
+
],
265
+
"displayName": "Home Realm Discovery auto acceleration",
266
+
"isOrganizationDefault": true
267
+
}
248
268
```
249
-
1. To see your new policy and get its ObjectID, run the following query:
269
+
1. To view your new policy, run the following query:
250
270
251
271
```http
252
-
GET https://graph.microsoft.com/v1.0/policies/homeRealmDiscoveryPolicies
272
+
GET /policies/homeRealmDiscoveryPolicies/{id}
253
273
```
254
274
1. To delete the HRD policy you created, run the query:
0 commit comments