[Access Control] How to Federate Only Subdomains with Access Control

Question

Among the domains managed in Microsoft 365, is there a way to Federate only the subdomain of domains that have a parent-child relationship with Access Control?

Answer

By separating the parent-child relationship between domains, you can Federate only the subdomain with Access Control.
* To restore the separated parent-child relationship, you must delete the child domain in Microsoft 365 and register it again while the parent domain is Verified.

Notes

1. When you perform the procedure in this article, the Microsoft 365 Login screen for users with the applicable subdomain will be changed to Access Control.
   All previous setup procedures, such as user synchronization and access control settings, must be completed in advance.
   [Access Control] List of Setup Procedures (Microsoft 365)
2. The Username and Password for the Microsoft 365 tenant Global Admin account are required.
3. The procedure in this article must be performed using a Microsoft 365 Global Admin account.
   * We recommend using the initial Microsoft 365 domain (a domain containing .onmicrosoft.com).
4. You cannot Federate the default domain.
5. Global Admin privileges for Access Control are required to verify the screens and change settings. 
   Please refer to the following article for how to access the Administration screen.
   [Access Control] How to Log in to the Administration 
6. When adding a domain in an environment where Federation was previously configured using PowerShell, performing this procedure also enables Federation for the added domain.

Preparation

Checking the Default Domain

Confirm that the domain can be Federated in the Microsoft 365 tenant.

1. Access the Microsoft 365 Administration screen and click ［View All］ in the menu on the left side of the screen.

2. Click ［Configuration］－［Domains］ in the menu on the left side of the screen.

3. Confirm that "Default" is displayed for the domain that will not be Federated in Microsoft 365.
   * If the domain to be Federated is the default domain, change the default domain by referring to the article below.
   Change the default domain for Microsoft 365

Integration with Microsoft

1. From the Access Control Administration screen, access ［System］－［Edit Connected Service］.

   

2. If the following settings do not exist in "Edit Connected Service," proceed to step 3.
   Name: Microsoft
   Type: Microsoft

3. Click ［Add Connected Service］ in the upper-right corner of the screen.

   

4. On the "Add New Service" screen, click ［Add Connected Service］.

   

5. Select ［Use a preset service］－［Microsoft］.

   

6. Configure the settings as necessary and click ［Save Changes］.

   

7. Return to the "Edit Connected Service" screen. The procedure is complete if the following settings exist.
   Name: Microsoft
   Type: Microsoft

Procedure

1. From the Access Control Administration screen, access ［System］－［Edit Connected Service］.

   

2. Select ［Microsoft］ created in Preparation - Integration with Microsoft.

   

3. On the "Edit Connected Service" screen, under "Access Policy Groups allowing this Connected Service," turn on ［Grant Permissions］ for the group that you want to allow access to Microsoft 365, and then click ［Save Changes］.
   ※Access Conditions can be controlled for each Access policy group.
   　For details, see the following article.
   [Access Control] Creating/Editing Access Policy Groups

   

4. Open "Edit Connected Service" again, and then click ［Federated Domains］－［Manage Domains］.

   

5. If the Microsoft 365 [Requested permissions] screen appears, select the [Consent on behalf of your organization] checkbox and then select [Accept].
   ※ If authentication has already been completed, select the user to proceed to the next screen.

6. On the "Manage Domains" screen, click ［Separate］ for the child domain that you want to Federate.

   

7. Review the details on the confirmation screen and select the checkbox.
   Then click ［Separate］.

   

8. Confirm that the Status of the separated domain is "Not Federated," and then click ［Federate］.

   

9. Review the details on the confirmation screen, and then click ［Federate Domain］.

   

10. The procedure is complete when the Status of the target domain changes to "Federated."

    

Translation Disclaimer

This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.

In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.