--- updatedAt: 2026-05-14T16:48:22.000Z --- # Azure AD Join # Introduction This document provides instructions on how configure Azure AD join using IBM® Verify as the Identity Provider. You need following Prerequisites: * Azure AD with administrator access * Windows device with Powershell and Microsoft Online Services Module installed. * IBM Verify domain with administrator access. Complete the following tasks: * Azure Active Directory * Enable device joining * Configure a federated Azure AD Domain * Provision user to Azure AD with Powershell commands * IBM Verify * Configure Microsoft 365 application (WS-Federation) ## Enabling device joining and configuring a federated Azure AD domain ### Enabling device joining 1. Login to the Azure portal . 2. Configure the device settings as shown below to allow user to join device to Azure AD, disable the MFA settings at Azure AD side to avoid double MFA. [block:image] { "images": [ { "image": [ "https://files.readme.io/0f699427e442dcf3488548638c5888a8e66727e9d19fbfb2d031399ba0bb58b7-configure-azure-ad-join-AzureDeviceSettings.png", "0f699427e442dcf3488548638c5888a8e66727e9d19fbfb2d031399ba0bb58b7-configure-azure-ad-join-AzureDeviceSettings.png", 1536, 864, "#1e4870", null, "69dfa1183848673f1a58313e" ] } ] } [/block] 3. \[Optional] Enable automatic Intune enrollment. During Azure AD join, the computer is automatically enrolled to Intune with the following configurations. * From the Azure portal, click Mobility (MDM and MAM) > Microsoft Intune [block:image] { "images": [ { "image": [ "https://files.readme.io/590dc98ddac5b2cb5726d81bd53eb598261afc6cada06e84ac0725d31c41439c-configure-azure-ad-join-AADJoinIntune.png", "590dc98ddac5b2cb5726d81bd53eb598261afc6cada06e84ac0725d31c41439c-configure-azure-ad-join-AADJoinIntune.png", 1536, 864, "#efefee", null, "69dfa11a39becab3f0e38b2f" ] } ] } [/block] * Set **All** for MDM user scope and save the settings. [block:image] { "images": [ { "image": [ "https://files.readme.io/6d4501561058e3972cfa593f76ba4c58d2c60635bbb8fae821f10c72b6340b0c-configure-azure-ad-join-AADJoinIntuneEnabled.png", "6d4501561058e3972cfa593f76ba4c58d2c60635bbb8fae821f10c72b6340b0c-configure-azure-ad-join-AADJoinIntuneEnabled.png", 1536, 864, "#1d4871", null, "69dfa11a5a5270afa071dca8" ] } ] } [/block] ### Configuring a federated Azure AD domain 1. In the Azure portal, create a custom domain. For example, `ibm.icu`. Ensure that it is verified. The custom domain is required to set up a federated Azure domain with a third party federation service. The main domain with `onmicrosoft.com` suffix does not support federated domain configuration. [block:image] { "images": [ { "image": [ "https://files.readme.io/6f3072af18f171ec4d88daf2e65f1766a6ae0968f91246d80b9979d0ba5a0613-configure-azure-ad-join-AzureCustomDomain.png", "6f3072af18f171ec4d88daf2e65f1766a6ae0968f91246d80b9979d0ba5a0613-configure-azure-ad-join-AzureCustomDomain.png", 1536, 864, "#efeff0", null, "69dfa11bf68f3a423b69011b" ] } ] } [/block] 2. Install Windows Powershell and Microsoft Online Services Module on the Windows machine. 3. Execute the following command in the Powershell command console: ``` Connect-MsolService ``` It prompts a login. 4. Specify the Azure admin user credential. This is the admin user upn with the `onmicrosoft.com` suffix. 5. After a successful login, execute the following command in the Powershell command console to create a federated domain with the IBM Verify tenant: (Please update the tenant hostname to your tenanthost accordingly, -DomainName ibm.icu is the custom domain created in step 1; -SigningCertificate is the public cert of the default cert of your tenant: ``` Set-MsolDomainAuthentication -Authentication federated -DomainName ibm.icu -FederationBrandName IbmSecurityVerify -IssuerUri https://dune.verify.ibm.com/wsf/sps/wsfedip/wsf -PassiveLogOnUri https://dune.verify.ibm.com/wsf/sps/wsfedip/wsf -ActiveLogOnUri https://dune.verify.ibm.com/wst/SecurityTokenService13 -MetadataExchangeUri https://dune.verify.ibm.com/wsf/sps/mex -LogOffUri https://dune.verify.ibm.com/idaas/mtfim/sps/idaas/logout -SigningCertificate MIIDYDCCAkigAwIBAgIEJDZp0DANBgkqhkiG9w0BAQsFADByMQkwBwYDVQQGEwAxCTAHBgNVBAgTADEJMAcGA1UEBxMAMQkwBwYDVQQKEwAxCTAHBgNVBAsTADE5MDcGA1UEAxMwc2FtbC1kZXYzLWNoZW55bS5kZXYudmVyaWZ5LmlibWNsb3Vkc2VjdXJpdHkuY29tMB4XDTIxMDMwODA1NTg0M1oXDTMxMDMwNjA1NTg0M1owcjEJMAcGA1UEBhMAMQkwBwYDVQQIEwAxCTAHBgNVBAcTADEJMAcGA1UEChMAMQkwBwYDVQQLEwAxOTA3BgNVBAMTMHNhbWwtZGV2My1jaGVueW0uZGV2LnZlcmlmeS5pYm1jbG91ZHNlY3VyaXR5LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIR0RqRWk9ii2hhfHQ1mSo83HowKdwlfsSjTEuctyfgvij/hHgTLjh6ZgqOxREycmtmdvABv2W7F+6Dzp+i/KvEMDgp5yNXzf0e5LY0x9pr8Vn0WKCROnq+w047CES2v5hsZ+6zJnHK5ZZA88NJmE2F0Q3/rRS6AUzrEhVknXryUm17HViTYT6tThXmAIBbbes3pNAP2XDKPNt0fQJuUTVMzUG82rtx2KR13Am0UwjmWcs85kBM9upUc4Y8jGFVp71ljsM59rHhQlrBkQIAmHGzm/KXdpa3th6GFP/k6g+qPfoaD4fsND7pNA0DBQP0r4S6Pc5+KqXTcRQznEoNBJ+cCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAWyDFxjm3dzLye2DbF09/S+97iLBYumsmrsl5cAHzdYqcUBURGhplyEseBog0NHdD3ygd2e0WAmIu1jhz+JuUleDgmaxbECnrO8KcGgM9g+/6cc9v/W3VkdOmweajQn/AuC9DxqGnoiKA5PzO9Fz+3ooTj3PkO1UbYXUwWk+zO4+w0Z0sMKuUpKVL/dOXT/phUp4vFWikc2C5KPG9FKNq4rUj2PHnhBKiXgjRgt3hDJKMcaEC12N4eUlmbwxIeNkda1m4yzhisPOwKFwy0aw/pECwUfdlZsxu523o0GX4MpaWS6DgpRpfysUuVODzPdGm7AZXXqoWhIgBLTMJ6AUEDQ== ``` 6. After successfully executing the command, type ``` Get-MsolDomainFederationSettings -DomainName ibm.icu ``` PS C:\Users\Scott> Get-MsolDomainFederationSettings -DomainName ibm.icu ``` ActiveLogOnUri : https://dune.verify.ibm.com/wst/SecurityTokenService13 DefaultInteractiveAuthenticationMethod : FederationBrandName : IbmSecurityVerify IssuerUri : https://dune.verify.ibm.com/wsf/sps/wsfedip/wsf LogOffUri : https://dune.verify.ibm.com/idaas/mtfim/sps/idaas/logout MetadataExchangeUri : https://dune.verify.ibm.com/wsf/sps/mex NextSigningCertificate : OpenIdConnectDiscoveryEndpoint : PassiveLogOnUri : https://dune.verify.ibm.com/wsf/sps/wsfedip/wsf SigningCertificate : MIIDYDCCAkigAwIBAgIEJDZp0DANBgkqhkiG9w0BAQsFADByMQkwBwYDVQQGEwAxCTAHBgNVBAgTAD EJMAcGA1UEBxMAMQkwBwYDVQQKEwAxCTAHBgNVBAsTADE5MDcGA1UEAxMwc2FtbC1kZXYzLWNoZW55 bS5kZXYudmVyaWZ5LmlibWNsb3Vkc2VjdXJpdHkuY29tMB4XDTIxMDMwODA1NTg0M1oXDTMxMDMwNj A1NTg0M1owcjEJMAcGA1UEBhMAMQkwBwYDVQQIEwAxCTAHBgNVBAcTADEJMAcGA1UEChMAMQkwBwYD VQQLEwAxOTA3BgNVBAMTMHNhbWwtZGV2My1jaGVueW0uZGV2LnZlcmlmeS5pYm1jbG91ZHNlY3VyaX R5LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIR0RqRWk9ii2hhfHQ1mSo83HowK dwlfsSjTEuctyfgvij/hHgTLjh6ZgqOxREycmtmdvABv2W7F+6Dzp+i/KvEMDgp5yNXzf0e5LY0x9p r8Vn0WKCROnq+w047CES2v5hsZ+6zJnHK5ZZA88NJmE2F0Q3/rRS6AUzrEhVknXryUm17HViTYT6tT hXmAIBbbes3pNAP2XDKPNt0fQJuUTVMzUG82rtx2KR13Am0UwjmWcs85kBM9upUc4Y8jGFVp71ljsM 59rHhQlrBkQIAmHGzm/KXdpa3th6GFP/k6g+qPfoaD4fsND7pNA0DBQP0r4S6Pc5+KqXTcRQznEoNB J+cCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAWyDFxjm3dzLye2DbF09/S+97iLBYumsmrsl5cAHzdY qcUBURGhplyEseBog0NHdD3ygd2e0WAmIu1jhz+JuUleDgmaxbECnrO8KcGgM9g+/6cc9v/W3VkdOm weajQn/AuC9DxqGnoiKA5PzO9Fz+3ooTj3PkO1UbYXUwWk+zO4+w0Z0sMKuUpKVL/dOXT/phUp4vFW ikc2C5KPG9FKNq4rUj2PHnhBKiXgjRgt3hDJKMcaEC12N4eUlmbwxIeNkda1m4yzhisPOwKFwy0aw/ pECwUfdlZsxu523o0GX4MpaWS6DgpRpfysUuVODzPdGm7AZXXqoWhIgBLTMJ6AUEDQ== SupportsMfa : ``` It shows the federated domain settings. 7. Verify all fields are correct. ### Provisioning user to Azure AD with Powershell commands 1. Provision the user in Azure AD. Decide which user attribute from the IBM Verify user will be used as the `immutabeid` and `upn` in the Azure AD. 2. Execute the following command in the Powershell command console: ``` New-MsolUser -userprincipalname testuser@ibm.icu -immutableID testuserimmutableid -lastname test -firstname user -Displayname "test user" -LicenseAssignment "isvsts:DEVELOPERPACK_E5" -usageLocation SG ``` This provisions a user with `upn: testuser@ibm.icu` and `immutableID: testuserimmutableid`. 3. Run following command to verify that the `immutableid` was created correctly. ``` Get-MsolUser -UserPrincipalName "testuser@ibm.icu" | Select ImmutableID ``` ## Configuring Microsoft 365 application (WS-Federation) ### From IBM Verify tenant Administrative Console 1. Create Microsoft 365 application. 1. Select **Applications** > **Applications**. 2. Click **Add application**. 3. In the **Select Application Type** pop-up, add the Microsoft365 application. 2. In the **Sign-on** tab, select **WS-Federation** as the **Sign-on method**. Use the default settings except for SAML subject Name identifier. 3. Select an attribute source for UPN and ImmutableID. The **UPN** and **ImmutableID** value must match the UPN and ImmutableID in the Azure AD user registry. 4. Save the application. 5. In the **Applications** page, select the Microsoft365 application and click **Settings**. Click on the 'Entitlements' tab, select an **Access type** and select the **Approvers** check-box accordingly. ## Run the flow 1. Join the Windows 10 computer to Azure AD. 1. From **Settings** > **Accounts** > **Access work or school**. 2. Click Connect. [block:image] { "images": [ { "image": [ "https://files.readme.io/1dced192bc3898e2c2d688b107e80baa3bb2bc84197da5aae6f6860f2caa1a0d-configure-azure-ad-join-AADJoinConnect.png", "1dced192bc3898e2c2d688b107e80baa3bb2bc84197da5aae6f6860f2caa1a0d-configure-azure-ad-join-AADJoinConnect.png", 805, 801, "#e2e2e2", null, "69dfa11cf6bb474bc5e5d82e" ] } ] } [/block] 2. Click **Join this device to Azure Active Directory**. [block:image] { "images": [ { "image": [ "https://files.readme.io/4d4075f261b79e8b47eca6b50ca076cae8edb336cc6a6e77e604806aa420e00f-configure-azure-ad-join-AADJoin.png", "4d4075f261b79e8b47eca6b50ca076cae8edb336cc6a6e77e604806aa420e00f-configure-azure-ad-join-AADJoin.png", 660, 801, "#c8cfcc", null, "69dfa11d822715b16e41bbbc" ] } ] } [/block] 3. Specify the upn with the custom domain. For example, `testuser@ibm.icu`. 4. Click **Connect**. It redirects to IBM Verify to authenticate. After successful authentication, the following prompt is shown. Click **Join** to proceed. [block:image] { "images": [ { "image": [ "https://files.readme.io/191acc79d0cb2bfd9ee2348da9f5371557424ef709913772f663f1924ee3d221-configure-azure-ad-join-SettingsMFA.png", "191acc79d0cb2bfd9ee2348da9f5371557424ef709913772f663f1924ee3d221-configure-azure-ad-join-SettingsMFA.png", 922, 571, "#859c4f", null, "69dfa11ddf8b53a3d0281887" ] } ] } [/block] [block:image] { "images": [ { "image": [ "https://files.readme.io/2806783952bfc609947594a53e90fd142bf82e3f052d0f51d730210e0d9e4740-configure-azure-ad-join-AADJoinFinish.png", "2806783952bfc609947594a53e90fd142bf82e3f052d0f51d730210e0d9e4740-configure-azure-ad-join-AADJoinFinish.png", 820, 801, "#d7d7d7", null, "69dfa11e093338d3432756e2" ] } ] } [/block] 5. From the Azure portal devices, verify that the device is Azure AD joined. [block:image] { "images": [ { "image": [ "https://files.readme.io/6b44242f2fa805516db64d2dfb0f0cd23a3f5f5bcb4667acfe3a3766d22050b2-configure-azure-ad-join-AADJoinCheckDevice.png", "6b44242f2fa805516db64d2dfb0f0cd23a3f5f5bcb4667acfe3a3766d22050b2-configure-azure-ad-join-AADJoinCheckDevice.png", 1536, 864, "#1e4870", null, "69dfa11f14f1d33893c76e2a" ] } ] } [/block] 6. Login to the Azure AD joined computer with the IBM Verify user account.7. 7. Switch to login with Work or School account [block:image] { "images": [ { "image": [ "https://files.readme.io/1c6504b8262fd18ddc0cf11049edc742b6ccd000b7de7f369cfd1e472d9596b6-configure-azure-ad-join-AADJoinSwitchUser.png", "1c6504b8262fd18ddc0cf11049edc742b6ccd000b7de7f369cfd1e472d9596b6-configure-azure-ad-join-AADJoinSwitchUser.png", 764, 641, "#165d9a", null, "69dfa11f485ccd4bbf7bef31" ] } ] } [/block] 8. Specify the username and password of the IBM Verify user to log in. [block:image] { "images": [ { "image": [ "https://files.readme.io/4dd4dbcdc781758273811534c5a43de0e93e2b6b5587ebc61bd056d73c504d03-configure-azure-ad-join-AADJoinLoginDomainUser.png", "4dd4dbcdc781758273811534c5a43de0e93e2b6b5587ebc61bd056d73c504d03-configure-azure-ad-join-AADJoinLoginDomainUser.png", 821, 641, "#1f2929", null, "69dfa120485ccd4bbf7bef4e" ] } ] } [/block] ### OOBE (Azure AD join for fresh Windows installation) User can also join Windows 10 to Azure AD during the Windows installation process. Follow the screen prompts. [block:image] { "images": [ { "image": [ "https://files.readme.io/6b7a6645b18046694d212ae78b38d23f573f192ac92d338957111f44569d1880-configure-azure-ad-join-oobe1.png", "6b7a6645b18046694d212ae78b38d23f573f192ac92d338957111f44569d1880-configure-azure-ad-join-oobe1.png", 823, 613, "#7416df", null, "69dfa121025a06d15c880250" ] } ] } [/block] [block:image] { "images": [ { "image": [ "https://files.readme.io/085628bda5cf58b320f49d10fced01c3f20bb842e829577f31a5152e2d5a0865-configure-azure-ad-join-oobe2.png", "085628bda5cf58b320f49d10fced01c3f20bb842e829577f31a5152e2d5a0865-configure-azure-ad-join-oobe2.png", 824, 612, "#73f69f", null, "69dfa1220baacca2bd76d03e" ] } ] } [/block] [block:image] { "images": [ { "image": [ "https://files.readme.io/4f3253f982742f7f4337c71b798fd6127d1b64ffe019cbda3e8a812ee3959616-configure-azure-ad-join-oobe3.png", "4f3253f982742f7f4337c71b798fd6127d1b64ffe019cbda3e8a812ee3959616-configure-azure-ad-join-oobe3.png", 825, 613, "#1d2532", null, "69dfa12250cd4f2d296febdc" ] } ] } [/block]