[Access Control] Test Federate Integration with Microsoft 365 Using a Subdomain Before Company-Wide Deployment

Question

Before rolling out Access Control operations company-wide, we would like to federate only a test subdomain with Microsoft 365 and conduct login testing.

Answer

By following the procedure below, you can federate only a Microsoft 365 test subdomain with Access Control and test logging in using only subdomain users.

Notes

1. This procedure requires a Microsoft 365 Global Administrator account and Global Admin privileges for Access Control.
2. The contents of this article are based on product information as of August 2026 and may be changed without prior notice.
3. For specifications and settings related to Microsoft 365, please contact Microsoft.
4. Federation cannot be enabled for domains set as the "default domain" in Microsoft 365.
5. The test subdomain must be registered in the HENNGE Tenant.
   For details, see ［Prerequisites］－［Domain Capture Submission］ in this article.
6. If the parent domain is already federated with Access Control, you must Remove the federation to proceed with this Procedure.
   Please note that it may take a few hours for the federation removal to take effect.
7. For information on how to access the Administration, please refer to the article below.
   [Access Control] How to Log in to the Administration  

Procedure

Preparing the Test Subdomain

1. Access the Microsoft Entra admin center, then click ［Domain names］－［Add custom domain］.
2. Enter the subdomain to be used for testing, then click "Add domain."
3. A confirmation screen for the added domain will be displayed. Close it.
4. Return to the Custom Domains Summary and confirm that the added test subdomain is displayed.
   ※If you use email services such as Outlook with the added domain, DNS record configuration is required.

Domain Capture Submission

※Even if you submitted a domain capture before adding the subdomain, you must submit it again.

1. Access the Microsoft 365 admin center and open the domain management screen from ［Configuration］－［Domains］.

   

2. Confirm that the added domain is displayed, and share a screenshot of the domain management screen with the HENNGE implementation representative.

Testing Federation with a Subdomain

1. Create a test user with the subdomain added in Prepare a subdomain for testing in Access Control.
   For instructions on creating users in Access Control, please refer to the following article:
   [Access Control] New User Creation / Edit
2. Configure Provisioning Settings from Access Control to Microsoft 365 for the test subdomain added in Prepare a subdomain for testing.
   ※User synchronization is performed on a domain-by-domain basis. Be sure to specify the test subdomain.
   For detailed instructions, please refer to the following article:
   [Access Control] User Sync Settings (Access Control → Microsoft 365) 
3. Create a test Access policy group and assign it to the test user created in Step 2.
   For details, please refer to the following articles:
   [Access Control] Creating/Editing Access Policy Groups
   Assign Access Policy Group to Users (Modern View)
4. Separate the parent-child relationship between domains and configure federation for the subdomain.
   For details, please refer to the following article:
   [Access Control] How to Federate Only Subdomains with Access Control
   ※After federation is performed, it may take a few hours for the changes to be reflected in the actual product.
   ※The time required for federation changes to take effect may vary depending on the user.
5. From the Access Control User Portal of the test user, test whether single sign-on to the Microsoft 365 portal is possible.
   For login behavior to Microsoft 365 via Access Control, please refer to the following page to confirm whether the test was successful.
   [Access Control] How to Log in to Microsoft 365 via Access Control
   ※If the user has not been assigned a Microsoft 365 license, they can log in to the Microsoft 365 portal but cannot log in to applications such as Outlook.

Translation Disclaimer

This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.

In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.