[Access Control] How to Federate Only a Subdomain with Access Control

Question

For domains managed in Microsoft 365 that have a parent-child relationship, is it possible to federate only the subdomain with Access Control?

Answer

By removing the parent-child relationship between domains, you can federate only the subdomain with Access Control.
※ To restore the removed parent-child relationship, you must delete the child domain in Microsoft 365 and register it again after the parent domain has been verified.

Notes

1. When you complete the Procedure in this article, the Microsoft 365 sign-in screen for users with the applicable subdomain will be changed to Access Control.
   All previous implementation procedures, such as user synchronization and access control settings, must be completed in advance.
   [Access Control] Implementation Procedure Summary (Microsoft 365)
2. You need the information for the Microsoft 365 tenant Global Administrator account (username and password).
3. The Procedure in this article requires work using a Microsoft 365 Global Administrator account.
   ※ We recommend using the initial Microsoft 365 domain (the domain that includes .onmicrosoft.com).
4. Federation cannot be enabled for the default domain.
5. Global Administrator privileges for Access Control are required to check the actual screens and change settings. 
   Please refer to the following article for how to access the administration screen.
   [Access Control] How to Log in to the Administration 
6. When adding a domain in an environment previously federated using PowerShell, performing this Procedure also enables federation for the additional domain.

Preparation

Checking the Default Domain

Check that federation is available for the Microsoft 365 tenant.

1. Access the Microsoft 365 administration screen, then click ［Show all］ in the menu on the left side of the screen.

2. Click ［Settings］－［Domains］ in the menu on the left side of the screen.

3. Verify that “Default” is displayed for the domain that will not be federated with Microsoft 365.
   ※ If the Target domain for federation is the default domain, change the default domain by referring to the following article.
   Change the default domain for Microsoft 365

Integration with Microsoft

1. From the Access Control administration screen, access ［System］－［Service Provider Settings］.

   

2. If the following settings do not exist in “Service Provider Settings,” proceed to Procedure 3.
   Display name: Microsoft
   Type: Microsoft

3. Click ［Add Service］ in the upper-right corner of the screen.

   

4. On the “Add New Service” screen, click ［Add Service］.

   

5. Select ［Use Preset］－［Microsoft］.

   

6. Configure settings as necessary, then click ［Apply Changes］.

   

7. Return to the “Service Provider Settings” screen. The setup is complete if the following settings exist.
   Display name: Microsoft
   Type: Microsoft

Procedure

1. From the Access Control administration screen, access ［System］－［Service Provider Settings］.

   

2. Select ［Microsoft］ created in Preparation－Integration with Microsoft.

   

3. On the “Service Provider Settings” screen, under “Access policy groups that allow this service provider,” turn on ［Allow］ for the group to which you want to allow access to Microsoft 365, then click ［Apply Changes］.
   ※ Access conditions can be controlled for each access policy group.
   　For details, please refer to the following article.
   [Access Control] Creating/Editing Access Policy Groups

   

4. Open “Service Provider Settings” again, then click ［Federated Domains］－［Manage Domains］.

   

5. If the Microsoft 365 ［Permissions requested］ screen is displayed, select the ［Consent on behalf of your organization］ checkbox and then select ［Accept］.
   ※ If authentication has already been completed, select the user to proceed to the next screen.

6. On the “Domain Management” screen, click ［Unlink］ for the subdomain you want to federate.

   

7. Review the details on the confirmation screen and select the checkbox.
   Then, click ［Unlink］.

   

8. Verify that the status of the unlinked domain is “Not Federated,” then click ［Federate］.

   

9. Review the details on the confirmation screen, then click ［Configure Federation］.

   

10. The procedure is complete when the status of the Target domain changes to “Federated.”

    

Translation Disclaimer

This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.

In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.