> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/integrations/authentication/pre-built-integrations/office-365.md).

# Office 365

***

### Overview

Enable passwordless, biometric login for your Microsoft Office 365 users using 1Kosmos as a SAML 2.0 Identity Provider. Once connected, users authenticate with Touch ID, Face ID, or LiveID.

### **Prerequisites**

Before starting, make sure you have:

* AdminX portal — Admin access to your 1Kosmos AdminX tenant.
* Office 365 tenant — Admin access to your Microsoft Office 365 environment.
* Office 365 metadata — Downloaded and stored locally on your machine.
* LDAP or Active Directory — A 1Kosmos user directory configured with AD or LDAP.
* Microsoft AzureAD module for Windows PowerShell — Installed on your machine.
* 1Kosmos mobile app — Installed and enrolled on iOS or Android.

### Integration Steps

#### Step 1 — Add the ImmutableID Attribute in 1Kosmos

1. Log in to your 1Kosmos tenant as a community administrator.
2. Navigate to **Settings → 1Kosmos Attributes**.
3. Click Add New.
4. Under Name, enter immutableid and click **Create**.
5. Verify the immutableid attribute appears under 1Kosmos Attributes.

#### Step 2 — Map the ImmutableID Attribute to Active Directory

1. Navigate to Directory → Directory Integrations.
2. Scroll to your AD or LDAP user directory and click the edit icon.
3. Click the **Attributes Mapping** tab.
4. Click Add New Mapping and enter the following:

Directory Attribute: postalcode 1Kosmos Attribute: immutableid

5. Click Create and confirm the mapping appears.

#### Step 3 — Add Office 365 as a Service Provider in AdminX

1. Log in to your tenant as a community administrator and navigate to Applications → Add Application.
2. Scroll to SAML 2.0 Generic and click Add Integration.
3. Review the displayed information and click Add Application.

#### Basic Settings:

Application Name: Office365 Instance: Production or Sandbox Application Access URL: <https://login.microsoftonline.com/login.srf>

Click Next.

#### SAML Settings:

1. Click Upload and select the Office 365 metadata file downloaded during prerequisites.
2. Under Assertion Statement (NameID), select:
   * Format: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
   * Value: immutableid
3. Under Claims Mapping, click Add New and enter:

&#x20;      Attribute: email Format:     <http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mail>

4. Click Next.

**Advanced Options**

1. Confirm the following details are populated from the uploaded metadata:
2. Entity ID: urn:federation:MicrosoftOnline Assertion Consumer Service Method: POST Assertion Consumer Service URL: <https://login.microsoftonline.com/login.srf>
3. Ensure Assertion and Authentication Request switches are enabled and Signing Certificate and Encryption Certificate fields are populated.
4. Click Save.

#### Step 4 — Configure 1Kosmos in Office 365

Note: Ensure the AzureAD module for Windows PowerShell is installed before continuing.

1. Launch Windows PowerShell and connect to your Azure AD domain:

&#x20;     Connect-MsolService

2. Sign in with your domain administrator credentials.
3. Check your domain status:

&#x20;     Get-MsolDomain -Domainname

4. Set the following variables (replace with your own values):

```
$domainname = "yourdomain.com" $logoffuri = "https://.1kosmos.net/adminapi/community//slo" $passivelogonuri = "https://.1kosmos.net/adminapi/community//sso" $cert = "" $issueruri = "https://.1kosmos.net/newui//idp3" $protocol = "SAMLP"
```

5. Run the following command to federate your domain:

```
Set-MsolDomainAuthentication -DomainName $domainname -FederationBrandName AdminX -Authentication Federated -IssuerUri $issueruri -LogOffUri $logoffuri -PassiveLogOnUri $passivelogonuri -SigningCertificate $cert -PreferredAuthenticationProtocol $protocol
```

6. Validate your configuration:

```
Get-MsolDomainFederationSettings -DomainName | Format-List
```

#### Step 5 — Test the Integration

1. Open a browser and navigate to [https://www.office.com](https://www.office.com/) and click Sign in.
2. Enter your user email address and click Next.
3. You will be redirected to the 1Kosmos login page.
4. Scan the QR code using the 1Kosmos mobile app.
5. Complete biometric authentication (Touch ID, Face ID, or LiveID).
6. On success, you will be logged in to the Office 365 portal.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/integrations/authentication/pre-built-integrations/office-365.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.