Centrify for Office 365 Deployment
Guide
Abstract
This document is a step by step configuration guide to deploy Office 365 with Centrify Identity Service
for Federation and is intended for IT professionals with basic understanding of computing systems.
© 2014 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 1
CENTRIFY O365
DEPLOYEMNT GUIDE
Information in this document, including URL and other Internet Web site references, is subject to
change without notice. Unless otherwise noted, the example companies, organizations, products,
domain names, email addresses, logos, people, places and events depicted herein are fictitious, and
no association with any real company, organization, product, domain name, e-mail address, logo,
person, place or event is intended or should be inferred. Complying with all applicable copyright laws
is the responsibility of the user. Without limiting the rights under copyright, no part of this document
may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by
any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose,
without the express written permission of Centrify Corporation.
Centrify may have patents, patent applications, trademarks, copyrights, or other intellectual property
rights covering subject matter in this document. Except as expressly provided in any written license
agreement from Centrify, the furnishing of this document does not give you any license to these
patents, trademarks, copyrights, or other intellectual property.
© 2015 Centrify Corporation. All rights reserved.
Centrify, DirectControl and DirectAudit are registered trademarks and Centrify Suite, DirectAuthorize,
DirectSecure and DirectManage are trademarks of Centrify Corporation in the United States and/or
other countries. Microsoft, Active Directory, Windows, Windows NT, and Windows Server are either
registered trademarks or trademarks of Microsoft Corporation in the United States and/or other
countries.
The names of actual companies and products mentioned herein may be the trademarks of their
respective owners.
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 2
CENTRIFY O365
DEPLOYEMNT GUIDE
Contents
Contents ............................................................................................................ 3
Overview ........................................................................................................... 4
Where will your identities live? ................................................................... 4
Prepare Your Centrify Identity Service Environment...................................... 5
Add Your UPN Domain to Office 365 ........................................................... 5
Connect Centrify with Office 365 and Synchronize Active Directory User IDs .... 6
Validate Synchronization and Verify Federation in a Test Environment ............ 6
Prerequisites: .................................................................................................... 7
Configure Office 365 .......................................................................................... 7
Federating Centrify User Suite with O365 ........................................................ 15
How to delete users from O365 using PowerShell ........................................... 32
How to Contact Centrify ................................................................................... 33
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 3
CENTRIFY O365
DEPLOYEMNT GUIDE
Overview
Many people are moving to an Office 365 environment to simplify control and maintenance of some of
their core systems. These benefits can include the following:

Overtime reduced for technical staff’s support for email systems.

Reduction in on-premises storage requirements.

Reduction in on-premises hardware requirements.

Improved availability of service and redundancy (99.9% up SLA).

Less concern for individual mailbox storage requirements.

The ability to have a hybrid exchange model for hosting mailboxes locally, for situations where
the hosted solution may not work.

Single Sign-on (SSO) federated to your on premises Active Directory (AD).

And last but not least, automated provisioning of users from AD.
But before you run out and sign up for Office 365 and implement SSO, there are some best practices
and considerations you should review. This document will highlight the key things you should know
before you go to an Office 365 federated environment.
Where will your identities live?
For most of you going to Office 365, you probably have an on premises Active Directory environment.
Some of you may use SSO vendors which require you to replicate all of your AD identities to their
cloud service. Centrify feels that this is an unnecessary step that forces customers to give up a degree
of control, is less secure, and forces vendor lock-in. Some SSO solutions require you to have up to
eight different servers to provide the same functionality that Centrify can achieve with our Identity
Service Cloud Connectors that can be deployed on existing servers. We believe that your FTE
identities should stay on premise and that your 3rd party or contractor identities should live
separately.
We provide our Cloud User Identity Service for just that hybrid scenario. We provide a model that
addresses the complete application end-user life-cycle. We handle the process from on-boarding to
application authorization for both mobile and web, and when the time comes you have a single point
of de-provisioning.
Having said that, this is a great opportunity to do some AD cleanup and make sure you are ready for
a federated Office 365 environment.
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 4
CENTRIFY O365
DEPLOYEMNT GUIDE
UPNs and Domain name
One of the things that AD brought us was the ability to have non-routable local domain suffixes such
as “mycompany.local”. This is a great security practice and reduces the ability to hack from the
outside. But guess what? Before you can go to Office 365 or federate to AD you need to use an
Internet-resolvable domain name as the suffix in each user’s username. If you have a .local domain
you now need to add the Internet routable domain UPN suffix to Office 365 and AD. Don’t worry it’s
easy to add a UPN suffix. Here are the steps.

Open Active Directory Domains and Trusts.

In the console tree, right-click Active Directory Domains and Trusts, and then click Properties.

On the UPN Suffixes tab, type an alternative UPN suffix for the forest, and then click Add.
Prepare Your Centrify Identity Service Environment
If you are not already a Centrify customer it’s easy to get started with a trial at
http://www.centrify.com/saas/trial.asp. Centrify will also come on site and show you how to set
everything up for your proof of concept. Here is a great video from our CTO Paul Moore that shows
how the Cloud Identity service works. One note is that our proxy service has been renamed to Cloud
Connector. https://www.youtube.com/watch?v=ZTzJStHnahA
If you are a customer or you have signed up for our 30-day trial, the first thing you will get is a set of
credentials to administer the Cloud Identity Service. When you log in, the first thing to do is change
your administrator password and be sure to use a complex password. From there you will need to
install a cloud connector on any member server in your domain. It can be a physical server or
virtualized. You can have as many as you like and can have them distributed across your global
enterprise. You can find a short 5-minute video of the process here.
Add Your UPN Domain to Office 365
The earlier example used a publicly resolvable domain name of contoso.com with an internal Active
Directory domain of yourcompany.local. Your domain can be anything. The Active Directory name
doesn’t need to align with the external domain you use for e-mail addresses, although doing so
makes things easier for users to remember.
If the publicly resolvable domain name you choose isn’t already linked to Office 365, do so via the
Microsoft Online Services Portal. Click Domains in the Admin console and then select Add a Domain.
The wizard will prompt you for the domain name, and then give you one of two options for
authenticating ownership. You’ll need to add either a TXT or MX record to the publicly accessible DNS
server hosting the domain.
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 5
CENTRIFY O365
DEPLOYEMNT GUIDE
It can take anywhere from 15 minutes to 72 hours for the update to fully propagate, so it might take
a while before you can complete the validation process. Validation affirms to Office 365 that you own
the domain name your clients will later use to authenticate. You don’t need to have any servers within
this domain for federation to function. All you need to complete this step is the domain itself that you
can resolve from the Internet. You can find the “how to” video here.
Connect Centrify with Office 365 and Synchronize Active Directory User IDs
Now it’s time to configure Office 365 to federate user authentication. This process entrusts your
internal Active Directory domain with authenticating users, while letting Office 365 merely trust your
domain’s authentication response. That’s the cool thing about federation—no passwords are ever
transferred between ADFS and Office 365, it’s just a secure token exchange.
While federation removes the need to send passwords between Active Directory and Office 365, it still
requires that you continuously synchronize user accounts. You can perform this synchronization
manually and then edit each user to assign a license profile, or you can use the Centrify Identity
Service to not only synchronize users but provision them also.
Below are all three of Centrify’s Office 365 federation and provisioning “how to” videos that will take
you through all of the above necessary steps. Each video is about 5 minutes long.

Part I: https://www.youtube.com/watch?v=fsl1yGaXjsg

Part II: https://www.youtube.com/watch?v=8HZCrn7t9S8

Part III: https://www.youtube.com/watch?v=eYcQEw1qZ7k
Validate Synchronization and Verify Federation in a Test Environment
As with all projects it is best to validate in a test environment. You can easily sign up for a separate
O365 trial and use a sub domain or your externally routable domain, e.g. centrify.mydomain.com.
Centrify allows you to assign applications to individual users or groups of users so you can test with
pilot groups and then roll out to the entire enterprise.
Centrify’s online help system can help if you run in to any issues. And don’t forget to check out
Centrify’s SaaS community site for some additional resources.
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 6
CENTRIFY O365
DEPLOYEMNT GUIDE
Prerequisites:

Must have publicly resolvable Domain

Must have access to DNS Server to add / modify records for publicly resolvable domain

Must have Office 365 account with at least one License

Must have Centrify Cloud Tenant
Configure Office 365
1. Log on to Office Portal
2. Click on Domains
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 7
CENTRIFY O365
DEPLOYEMNT GUIDE
3. Click on add Domains
4. Click on Let’s get started
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 8
CENTRIFY O365
DEPLOYEMNT GUIDE
5. Enter your Domain name and click on Next
6. If your Domain is register with GoDaddy (like in my example) you can simply sign into
GoDaddy and let the wizard modify/add the DNS records needed for Domain verification.
It is beyond the scope of this document to explore all variations of DNS servers and how
to configure such. After completing the DNS Wizard / manually adding the TXT record
needed for Domain verification you’ll see a confirmation about Domain Ownership.
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 9
CENTRIFY O365
DEPLOYEMNT GUIDE
7. If this is the first time / domain you are setting up O365 you’ll be prompted to change
the default admin email address. You can skip this step.
8. You’ll be prompted to add Users. You can Skip this step
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 10
CENTRIFY O365
DEPLOYEMNT GUIDE
9. At the “Update DNS records” prompt click on “Next”
10. Depending on your license you can use Outlook and Lync services. Select which services
you want to enable and click on Next
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 11
CENTRIFY O365
DEPLOYEMNT GUIDE
11. Add the DNS records provided by O365. In my example I am using GoDaddy as DNS
service provider and will add those records automatically.
12. After adding the records click on Finish
13. If all settings are correct you will see the following screen
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 12
CENTRIFY O365
DEPLOYEMNT GUIDE
14. Expand User on the left side and click on Active Users
15. Click on Active Directory synchronization: Set up| at the top of the page
16. Click on Activate in “3 Active Directory synchronization”
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 13
CENTRIFY O365
DEPLOYEMNT GUIDE
17. Confirm any prompts
18. Done
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 14
CENTRIFY O365
DEPLOYEMNT GUIDE
Federating Centrify User Suite with O365
1. Log on to your Cloud Manager
2. Click on the Roles Tab
3. Click on Add Role
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 15
CENTRIFY O365
DEPLOYEMNT GUIDE
4. Enter a Name and Description for your Role
5. Example: O365-Users / Role for user access and license assignment for Office 365
6. Click OK to close the Add Role dialog
7. Click on the Apps tab
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 16
CENTRIFY O365
DEPLOYEMNT GUIDE
8. Click Add Web Apps
9. In the Add Web Apps dialog search for Office 365
10. Click on Add for “Office 365 WS-Fed + Provisioning”
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 17
CENTRIFY O365
DEPLOYEMNT GUIDE
11. Confirm any dialog and click on Close on the Add Web Apps dialog
12. NOTE: The Office 365 Application dialog will open automatically
13. Enter the Office 365 Admin Username and Password on the first screen
14. NOTE: You must use the Admin Credentials of the Default domain.onmicrosoft.com to log
on.
15. Click on Verify
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 18
CENTRIFY O365
DEPLOYEMNT GUIDE
16. Select the Domain you want to federate from the Office 365 Domains
17. From the Actions dropdown menu select Federate
18. NOTE: The default domain cannot be federated
19. Click Yes on the information dialog
20. NOTE: Federation can take up to 2 min
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 19
CENTRIFY O365
DEPLOYEMNT GUIDE
21. Click on Save
22. Click on User Access on the left side
23. Select the Role you created in step 3 to be assigned to Office 365 user access
24. Click on Save
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 20
CENTRIFY O365
DEPLOYEMNT GUIDE
25. Click on Provisioning on the left side
26. Select Enable Provisioning
27. Under Role Mappings click on Add
28. Select the Role add in step 3 to be associated with the License assignment
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 21
CENTRIFY O365
DEPLOYEMNT GUIDE
29. Select the License you want to associate with the Role
30. Click Done
31. Click Save
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 22
CENTRIFY O365
DEPLOYEMNT GUIDE
32. Click on the Users tab
33. Click on Add User
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 23
CENTRIFY O365
DEPLOYEMNT GUIDE
34. Configure the User
a)
b)
c)
d)
e)
Enter the logon name
Select the correct Domain name from the Suffix dropdown menu
Enter the email address
Enter and verify the password
Uncheck the Require password change at next logon (in this training exercise)
35. Scroll down and enter the display name
36. Click Create User
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 24
CENTRIFY O365
DEPLOYEMNT GUIDE
37. Click on Roles
38. Double Click your previously created Office 365 Role
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 25
CENTRIFY O365
DEPLOYEMNT GUIDE
39. Click on Members on the left side and click on Add
40. Enter the logon name into the search field
41. Select the User
42. Click on Add
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 26
CENTRIFY O365
DEPLOYEMNT GUIDE
43. Click on Save
44. Click Assigned Applications on the left side
45. Click Add
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 27
CENTRIFY O365
DEPLOYEMNT GUIDE
46. Select Office 365
47. Click Add
48. Click Save
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 28
CENTRIFY O365
DEPLOYEMNT GUIDE
49. Click on the Users tab
50. Select the User you just added to the Office 365 Role
51. Select Sync all Apps from the Action dropdown menu
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 29
CENTRIFY O365
DEPLOYEMNT GUIDE
52. Click Close
53.
54.
55.
56.
57.
Log on to your Office 365 administrative Portal
Expand the Users tree on the left side
Click on Active Users
Select the newly provisioned user
As you can see on the right side a license and email address has been provisioned for the
user
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 30
CENTRIFY O365
58.
59.
60.
61.
DEPLOYEMNT GUIDE
Open a new browser and go to cloud.centrify.com
Log on as the newly provisioned User
Click on the Office 365 application tile
Office will open in a new browser window
62. Done
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 31
CENTRIFY O365
DEPLOYEMNT GUIDE
How to delete users from O365 using PowerShell
When going through testing and evaluating Office 365 sometimes the same users are added and
removed from Office 365, however Office 365 has security mechanisms in place that the user is not
actually deleted. When removing the user from the user database the user is first placed in a
suspended mode where only the license and the right to log on is removed. In that state the user
remains in the “Active User” list on Office 365 for 30 days. At the end of the 30 days the user is then
moved to the “Recycle Bin” where the user will remain for another 90 days.
Office will deny to add the same user name since the SID for the new user with the same username
added to Office 365 is different from SID of the user who is in a suspended mode but has the same
user name. Office 365 detects the “new user” as a different user with the same username and thus
flags it as a duplicate denying the user to be added. Office 365 will deny to add “new” users with the
same username if a user with the same name is in the “Active Users” list as well as in the “Recycle
Bin”.
Since it doesn’t make for very efficient testing if one has to wait 120 days to reuse the same
username one can permanently delete users in real time from the Office 365 “Active User” list and
“Recycle Bin” using Windows Azure Power Shell commands.
1. Install Azure Power Shell
https://technet.microsoft.com/library/jj151815.aspx
2. Install Microsoft Online Services Sign-In Assistant 7.0 or greater
http://www.microsoft.com/en-us/download/details.aspx?id=28177
3. Install the Microsoft Online Services Module
Microsoft Online Services Module for Windows PowerShell (32-bit version)
Microsoft Online Services Module for Windows PowerShell (64-bit version)
4. Copy the folders called MSOnline and MSOnline Extended from the source
C:\Windows\System32\WindowsPowerShell\v1.0\Modules\
to the folder
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\
5. Open Azure Power Shell and run the following commands…

Import-Module MSOnline

$cred = get-credential
NOTE: When prompted, enter the admin credentials for the Office 365 Account managing the domain from which you
want to delete a user

Connect-MSOLService –credential $cred

Remove-MsolUser –UserPrincipalName [email protected]
NOTE: To point out the obvious, the user here has to be within a managed domain of the admin credentials that you
used to log on in step 5b

Remove-MsolUser –UserPrincipalName <account id> -RemoveFromRecycleBin
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 32
CENTRIFY O365
DEPLOYEMNT GUIDE
6. Sample output
PS C:\> $cred = get-credential (A second window will open to enter the
credentials)
cmdlet Get-Credential at command pipeline position 1
Supply values for the following parameters:
Credential
PS C:\> Connect-MSOLService –credential $cred
PS C:\> Remove-MsolUser –UserPrincipalName [email protected]
Confirm
Continue with this operation?
[Y] Yes
[N] No
[S] Suspend
[?] Help (default is "Y"): Y
PS C:\> Remove-MsolUser –UserPrincipalName [email protected] RemoveFromRecycleBin
Confirm
Continue with this operation?
[Y] Yes
[N] No
[S] Suspend
[?] Help (default is "Y"): Y
PS C:\>
How to Contact Centrify
North America
Europe, Middle East, Africa
(And All Locations Outside EMEA)
(EMEA)
Centrify Corporation
Centrify EMEA
785 N. Mary, Suite 200
Lilly Hill House
Sunnyvale, CA 94085
Lilly Hill Road
United States
Bracknell, Berkshire RG12 2SJ
United Kingdom
Sales:
+1 (408) 542-7500
Sales:
+44 (0) 1344 317950
Online: www.centrify.com/contact
© 2015 CENTRIFY CORPORATION. ALL RIGHTS RESERVED.
PAGE 33