[Access Control] Federation Connection Setup with Microsoft 365

Overview

For Access Control administrators, this article explains how to configure federation between Access Control and Microsoft 365 and log in to Microsoft 365 through Access Control.

Notes

1. Once you perform the Procedure in this article, the Microsoft 365 login screen will be changed to Access Control.
   All previous implementation Procedures, including user synchronization and access control settings, must be completed in advance.
   [Access Control] Implementation Procedure Summary (Microsoft 365)
2. You will need the information (username and password) for the Microsoft 365 tenant Global Administrator account.
3. The Procedure in this article requires work using a Microsoft 365 Global Administrator account.
   ※ We recommend using the initial Microsoft 365 domain (a domain that includes .onmicrosoft.com).
4. The content of this article is based on product information as of November 2026 and may be changed without prior notice.
5. Federation cannot be enabled for the default domain.
6. Access Control Global Administrator privileges are required to check the actual screens and change settings. 
   Please refer to the following article for how to access the Administration screen.
   [Access Control] How to Log in to the Administration 
7. When adding a domain in an environment that was previously connected through federation using PowerShell, performing this Procedure will also enable federation connection for the added domain.

Preparation

Checking the Default Domain

Verify that federation is available in the Microsoft 365 tenant.

1. Access the Microsoft 365 Administration screen and click ［Show all］ in the menu on the left side of the screen.

2. Click ［Settings］－［Domains］ in the menu on the left side of the screen.

3. Verify that "Default" is displayed for the domain that will not be federated with Microsoft 365.
   ※ If the Target domain for federation is the default domain, change the default domain by referring to the article below.
   Change the default domain for Microsoft 365

Integration with Microsoft

1. From the Access Control Administration screen, access ［System］－［Service Provider Settings］.

   

2. If the following settings do not exist in "Service Provider Settings," proceed to Procedure 3.
   Display name: Microsoft
   Type: Microsoft

3. Click ［Add Service］ in the upper-right corner of the screen.

   

4. Click ［Add Service］ on the "Add New Service" screen.

   

5. Select ［Use Preset］－［Microsoft］.

   

6. Configure additional settings as necessary, then click ［Change］.

   

7. Return to the "Service Provider Settings" screen. The setup is complete if the following settings exist.
   ※ If you changed the service name, the display name will also be changed.
   Display name: Microsoft
   Type: Microsoft

Procedure

1. From the Access Control Administration, navigate to ［System］－［Service Provider Settings］.

   

2. Select ［Microsoft］ created in Preparation－Integration with Microsoft.

   

3. On the 「Service Provider Settings」 screen, under 「Access policy groups that allow this service provider」, turn on ［Allow］ for the group to permit access to Microsoft 365, and then click ［Apply Changes］.
   ※ Access conditions can be controlled for each access policy group.
   　For details, please refer to the following article.
   [Access Control] Creating/Editing Access Policy Groups

   

4. Open 「Service Provider Settings」 again, and then click ［Domains in Federation］－［Manage Domains］.

   

5. The [Requested permissions] screen is displayed. Select the checkbox for [Consent on behalf of your organization] and then select [Accept].
   ※ If the next screen appears without this screen being displayed, authentication has already been completed. Proceed to the next Procedure.

6. The 「Domain Management」 screen is displayed. Click ［Federation］ for the domain to federate.

   

   ※ To upgrade a domain that was previously federated using Powershell, click ［Upgrade］ for the domain marked ［Federated (Legacy Procedure)］.

   

7. A pop-up window is displayed. Review the Notes, and if there are no issues, select the checkbox for [ I confirm that the required Procedures have been completed. ] and click ［Configure Federation］.
   ※ For an upgrade, ［Upgrade］ is displayed.
   [Access Control] Should I perform the "Upgrade" on the Federate settings screen?
   ※ When federating a parent domain (for example, example.com), its subdomains (for example, sub.example.com) are also automatically included in the same federation Target.
   ※ After completing this Procedure, users will log in to Microsoft 365 via Access Control.
   All previous implementation Procedures, including user synchronization and access control settings, must be completed in advance.
   [Access Control] Implementation Procedure Summary (Microsoft 365)

   

8. Verify that the 「Status」 of the Target domain is 「Federated」, and then click ［Close］.

   

Translation Disclaimer

This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.

In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.