[Access Control] Federate Connection with Microsoft 365 Using a Test Subdomain

Target Audience

This article is intended for customers who federate Microsoft 365 authentication with Access Control and wish to conduct testing using a test domain before company-wide deployment.

Purpose

Configure federation between Access Control and Microsoft 365 for a test subdomain so that Users with an Email Address in the relevant domain log in to Microsoft 365 through Access Control.

Notes

1. This procedure requires a Microsoft 365 Global Admin account and Global Admin privileges for Access Control.
2. The content of this article is based on the product as of August 2026 and may be changed without prior notice.
3. For specifications and settings related to Microsoft 365, please contact Microsoft.
4. Federation cannot be enabled for a domain set as the "default domain" in Microsoft 365.
5. The test subdomain must be registered with the HENNGE Tenant.
   For details, see [Prerequisites]-[Sending a Domain Capture] in this article.
6. If the parent domain is already federated with Access Control, you must remove the federation to proceed with this procedure.
   Please note that it may take several hours for the federation removal to take effect.
7. For information on how to access the Administration, please refer to the following article.
   [Access Control] How to Log in to the Administration  

Procedure

Preparing a Test Subdomain

1. Access the Microsoft Entra admin center, then click [Domain Name] > [Add Custom Domain].
2. Enter the subdomain to be used for testing, then click "Add Domain."
3. The confirmation screen for the added domain will be displayed; close it.
4. Return to the Custom Domains Summary and confirm that the added test subdomain is displayed.
   Note: If you use email services such as Outlook with the added domain, DNS record configuration is required.

Sending a Domain Capture

Note: Even if you sent a domain capture before adding the subdomain, you must send it again.

1. Access the Microsoft 365 Administration Center and open the domain Administration screen from [ Configuration ] → [ Domains ].

   

2. Confirm that the added domain is displayed, then share a capture of the domain Administration screen with the HENNGE representative responsible for implementation.

Testing Federation with a Subdomain

1. Create a test User with the subdomain added in Preparing a Subdomain for Testing in Access Control.
   For instructions on creating Users in Access Control, please refer to the following article.
   [Access Control] New User Creation / Edit
2. Configure Provisioning Settings from Access Control to Microsoft 365 for the test subdomain added in Preparing a Subdomain for Testing.
   Note: User Synchronization is performed on a per-domain basis. Be sure to specify the test subdomain.
   For detailed instructions, please refer to the following article.
   [Access Control] User Sync Settings (Access Control → Microsoft 365) 
3. Create a test Access policy group and assign it to the test User created in step 2.
   For details, please refer to the following articles.
   [Access Control] Creating/Editing Access Policy Groups
   Assign Access Policy Group to Users (Modern View)
4. Separate the parent-child relationship between the domains and configure federation for the subdomain.
   For details, please refer to the following article.
   [Access Control] How to Federate Only a subdomain with Access Control
   Note: After federation is configured, it may take several hours for the changes to be reflected in the service.
   Note: The time required for federation changes to take effect may vary by User.
5. From the Access Control User Portal for the test User, test whether single sign-on to the Microsoft 365 portal is available.
   For login behavior to Microsoft 365 via Access Control, refer to the following page to confirm whether the test was successful.
   [Access Control] How to Log in to Microsoft 365 via Access Control
   Note: If the User has not been assigned a Microsoft 365 license, they can log in to the Microsoft 365 portal but cannot log in to applications such as Outlook.

Translation Disclaimer

This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.

In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.