Office 365

Enable passwordless, biometric authentication for Microsoft Office 365 using 1Kosmos as a SAML 2.0 Identity Provider — allowing users to sign in with Touch ID, Face ID, or LiveID instead of a password

---

Overview

Enable passwordless, biometric login for your Microsoft Office 365 users using 1Kosmos as a SAML 2.0 Identity Provider. Once connected, users authenticate with Touch ID, Face ID, or LiveID.

Prerequisites

Before starting, make sure you have:

• AdminX portal — Admin access to your 1Kosmos AdminX tenant.

• Office 365 tenant — Admin access to your Microsoft Office 365 environment.

• Office 365 metadata — Downloaded and stored locally on your machine.

• LDAP or Active Directory — A 1Kosmos user directory configured with AD or LDAP.

• Microsoft AzureAD module for Windows PowerShell — Installed on your machine.

• 1Kosmos mobile app — Installed and enrolled on iOS or Android.

Integration Steps

Step 1 — Add the ImmutableID Attribute in 1Kosmos

1. Log in to your 1Kosmos tenant as a community administrator.

2. Navigate to Settings → 1Kosmos Attributes.

3. Click Add New.

4. Under Name, enter immutableid and click Create.

5. Verify the immutableid attribute appears under 1Kosmos Attributes.

Step 2 — Map the ImmutableID Attribute to Active Directory

1. Navigate to Directory → Directory Integrations.

2. Scroll to your AD or LDAP user directory and click the edit icon.

3. Click the Attributes Mapping tab.

4. Click Add New Mapping and enter the following:

Directory Attribute: postalcode 1Kosmos Attribute: immutableid

1. Click Create and confirm the mapping appears.

Step 3 — Add Office 365 as a Service Provider in AdminX

1. Log in to your tenant as a community administrator and navigate to Applications → Add Application.

2. Scroll to SAML 2.0 Generic and click Add Integration.

3. Review the displayed information and click Add Application.

Basic Settings:

Application Name: Office365 Instance: Production or Sandbox Application Access URL: https://login.microsoftonline.com/login.srf

Click Next.

SAML Settings:

1. Click Upload and select the Office 365 metadata file downloaded during prerequisites.

2. Under Assertion Statement (NameID), select:

   • Format: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

   • Value: immutableid

3. Under Claims Mapping, click Add New and enter:

Attribute: email Format: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mail

1. Click Next.

Advanced Options

1. Confirm the following details are populated from the uploaded metadata:

2. Entity ID: urn:federation:MicrosoftOnline Assertion Consumer Service Method: POST Assertion Consumer Service URL: https://login.microsoftonline.com/login.srf

3. Ensure Assertion and Authentication Request switches are enabled and Signing Certificate and Encryption Certificate fields are populated.

4. Click Save.

Step 4 — Configure 1Kosmos in Office 365

Note: Ensure the AzureAD module for Windows PowerShell is installed before continuing.

1. Launch Windows PowerShell and connect to your Azure AD domain:

Connect-MsolService

1. Sign in with your domain administrator credentials.

2. Check your domain status:

Get-MsolDomain -Domainname

1. Set the following variables (replace with your own values):

$domainname = "yourdomain.com" $logoffuri = "https://.1kosmos.net/adminapi/community//slo" $passivelogonuri = "https://.1kosmos.net/adminapi/community//sso" $cert = "" $issueruri = "https://.1kosmos.net/newui//idp3" $protocol = "SAMLP"

1. Run the following command to federate your domain:

Set-MsolDomainAuthentication -DomainName $domainname -FederationBrandName AdminX -Authentication Federated -IssuerUri $issueruri -LogOffUri $logoffuri -PassiveLogOnUri $passivelogonuri -SigningCertificate $cert -PreferredAuthenticationProtocol $protocol

1. Validate your configuration:

Get-MsolDomainFederationSettings -DomainName | Format-List

Step 5 — Test the Integration

1. Open a browser and navigate to https://www.office.com and click Sign in.

2. Enter your user email address and click Next.

3. You will be redirected to the 1Kosmos login page.

4. Scan the QR code using the 1Kosmos mobile app.

5. Complete biometric authentication (Touch ID, Face ID, or LiveID).

6. On success, you will be logged in to the Office 365 portal.