Microsoft Outlook Web Access ADFS plugin integration

Open a PowerShell interface using a user with Administrative privileges for AD FS and Exchange.

Set the local variable $OwaUrl to your OWA URL:

$OwaUrl = ‘https://example.com/owa/’

Set the local variable $EcpUrl to your ECP URL:

$EcpUrl = ‘https://example.com/ecp/’

Create an issuance rule to authorize the users:

$IssuanceAuthRules = '@RuleTemplate = "AllowAllAuthzRule"
=> issue(Type = "http://schemas.microsoft.com/authorization/claims/permit",
Value = "true");'

Create Custom transformation rules for Active Directory users SID and Windows Account names:

$IssuanceTransformRules = '@RuleName = "ActiveDirectoryUserSID"
    c:[Type ==
    "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer
    == "AD AUTHORITY"]

    => issue(store = "Active Directory", types =
    ("http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid"), query =
    ";objectSID;{0}", param = c.Value);

  @RuleName = "ActiveDirectoryUPN"
    c:[Type ==
    "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer
    == "AD AUTHORITY"] 
        => issue(store = "Active Directory", types =
    ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"), query =
    ";userPrincipalName;{0}", param = c.Value);'

Note: if you need different transformation rules, see the Microsoft document about supported claims at https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/technical-reference/the-role-of-claims

Create rules for OWA:

Add-ADFSRelyingPartyTrust -Name 'Outlook Web App' -Enabled $true -WSFedEndpoint $ OwaUrl -Identifier $ OwaUrl -IssuanceTransformRules $IssuanceTransformRules -IssuanceAuthorizationRules $IssuanceAuthRules

Create rules for ECP:

Add-ADFSRelyingPartyTrust -Name Exchange Admin Center' -Enabled $true -WSFedEndpoint $ EcpUrl -Identifier $ EcpUrl -IssuanceTransformRules $IssuanceTransformRules -IssuanceAuthorizationRules $IssuanceAuthRules

Get the fingerprint of the certificate used to sign tokens in AD FS; you need this to configure Exchange:

Get-AdfsCertificate -CertificateType "Token-Signing"

Open the Exchange Management Shell.

Populate the variable for the OWA and ECP URLs:

$OwaUrl = ‘https://example.com/owa/’
$EcpUrl = ‘https://example.com/ecp/’

Configure the ADFS trust URL. Note that if you change the default endpoint from ‘adfs/ls’ you need to change it here as well:

$ADFS = ‘https://example.com/adfs/ls’

The ADFS certificate used to sign the tokens obtained in step 8 of the AD FS section in this document:

$certificate = ‘thefingerprint’

Setup the array of URLs that are going to be subject to AD FS authentication:

$urls = @($OwaUrl, EcpUrl)

Apply the configuration to your Exchange organisation:

Set-OrganizationConfig -AdfsIssuer $ADFS -AdfsAudienceUris $urls -AdfsSignCertificateThumbprint $certificate

Configure the Exchange ECP directory to use AD FS for authentication:

Set-EcpVirtualDirectory -AdfsAuthentication $true -BasicAuthentication $false -DigestAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false

Configure the Exchange OWA directory to use AD FS for authentication:

Set-OwaVirtualDirectory -AdfsAuthentication $true -BasicAuthentication $false -DigestAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false -OAuthAuthentication $false

Open the AD FS management console.

Navigate to the Authentication Policies > Multi-Factor Authentication and click on Edit.

The Multi-Factor Authentication configuration dialog appears, make sure that you have the Acceptto Authentication Provider. Optionally you may configure users and groups that you want to add to this policy.

Open a web browser and access https://example.com/owa

The browser redirects to your ADFS server, after typing in the Active Directory user and password, select continue. The It’sME mobile application will receive a push notification, approve the notification.

The Outlook Web Access page should open.

Open a web browser and access https://example/ecp

The browser redirects to your ADFS server, after typing in the Active Directory user and password, select continue. The It’sME mobile application will receive a push notification, approve the notification.

The Exchange Administration Control Panel page should open.

If you receive a notification such as WrongAudienceUriOrBadSigningCert, check that the URLs entered in the variables OwaUrl and EcpUrl precisely match the addresses used to access your Exchange OWA and ECP webpages. See Configure Exchange as a Service Provider (SP) for more detail.