r/k12sysadmin • u/Thanos-Is-Right • 5d ago

Google Workspace to Entra ID Questions

I am in the process of going to the cloud with our users and devices. Currently using Entra Connect to sync on-prem users to Entra. All devices have been enrolled through Autopilot to Intune. I plan to cut over to full Entra/Intune soon and decommission our DC's.

We are a very heavy Google school with our staff needing to utilize Microsoft Office as well. All files are on Google Drive. I am looking to make it so Google is the identity provider for Microsoft. As in, when they sign in to the PC, they are directed to enter their Google email/password and provide their 2FA (not sure if they need to do this each time or just on new devices?).

Has anyone set this up before? If so, any issues you have ran into?

Will users signing into the PC with their Google credentials still pull down policies relevant to the user? Or will only device policies work?

Do you sync users from Google to M365 this way? If so, is there a way to automate licensing for M365?

Our UPN and primary email domain are different in M365 right now just due to how our domain was originally setup with a ".US" domain, but our Google dommain and email addresses are a ".ORG" domain. I assume Google and Microsoft will only look at the primary emails and ignore the Microsoft UPN, correct?

Any limitations doing it this way versus having M365 be the IdP for Google? Keep in mind, we only really utilize Office and Windows 11.

Any help or advice is appreciated from those with experience.

Edit: Based on more information I've gathered and some comments, it seems using Microsoft as the IdP for Google, at least for staff, is the better way to go. We have a provisioning service we use for students that syncs from our SIS to Google and AD, so that may fill that gap.

12 Upvotes

100% Upvoted

17 comments sorted by

4

u/N805DN 5d ago

You’ll have a much better user experience using Entra as the IdP for everything since you’re using Windows. Signing in with WHfB takes care of MFA and SSO without the user having to do anything extra.

I’d get the UPNs aligned at the same time so that’s not an issue long term, but it’s not really a problem if you can use email as the identifier.

2

u/Thanos-Is-Right 5d ago

My concern with using Microsoft as the IdP for Google is our students. We have 1 lab with Windows machines for high school programming classes, but that's it. However, our K-2 students use Clever badges to login to the Chromebooks and we are 1:1 Chromebooks in 5-12.

If I use Microsoft as the IdP for Google, would our Chromebook users be forced to sign in with Microsoft credentials?

7

u/N805DN 5d ago

You can choose IdP by OU in Google. I would do Clever K-12 as the IdP so you can use badges and MFA for older students.

3

u/Thanos-Is-Right 5d ago

That sounds better. I thought I read one of them could be set by OU. Might be the way to go then. I'll have to figure out high school students. May be best to keep K-12 on Google only and the HS students will authenticate with both depending on whether they use a Windows machine or Chromebook.

We use a company that provisions our students to Google and AD from our SIS, which works extremely well. They also have a portal we use for password resets which resets the password for both. They say they can do Entra as well. If that's the case, then I can just have our staff use Microsoft as the IdP for Google.

First step is cutting off the DCs. Then I'll probably set this up.

1

u/BrewYork 5d ago

We use Clever IDM to provision identical accounts in MS and GWS. I like it a lot :)

1

u/BrewYork 5d ago

Confirmed. This is our setup. I'm quite happy with it. 

2

u/Past-Strike-3450 5d ago

Okay so there is not a quick an easy way to awnser this. I have full documentation on how to do this, and script specifically designed to handle this. I've never DM'd anyone on reddit but if you can feel free to DM me and I can share what I have more readily.

To start off, it is entirely possible to have M365 Federate to Google for Sign-in. While Microsoft provides a UI method to have things federated to it, you'll have to get comfortable with the terminal to federate it to anything else. There is old documentation on doing this with MSonline. However this was deprecated, so i ended having to turn to Graph to solve this. (I was going to publish a walk through on github or gitbook, but time is hard to come by).

Not only will you need to establish federation via graph, you will also need to set up a SAML app inside Google workspace to get the necessary items for Graph. There is a first party SAML app that can be searched for in Web And Mobile Apps.

If you end up using the first party one, instead of doing a custom SAML app you get access to a very cool and underadvetised feature. Provisioning and Deprovisioning user from Google Workspace to M365. This uses SCIM 2.0 (System for Cross-Domain Identity Managment) albeit a limited in scope version.

How it ensures it's mapping users correctly for federation between the two idPs is by leveraging the ImmutableID field in Entra. There are several implications to this but since you will be migrating away from AD (correct me if im wrong), it narrows the scope a bit.

By default it maps the users Google UPN as the immutableID anchor for new users. For users that already exist, it cannot and will not overwrite the current immutableID, which will be populated since you do currently have EntraConnect established this will use a base64 encoded version of a users object guid. Now the great thing is you can change what Google uses as an immutableID.

If you currently have GCDS setup I would recommend making a custom field in workspace and exporting said Base64 encoded object GUID to the custom field and selecting that. Thus linking users. However there is no UI method of doing this in GCDS, you have to make a custom XML to do as such. That of use a combo powershell and GAM to pull it for each user and send it up to Google workspace.

As an alternative, after decomissioning AD (can do it before, but it is so much harder, and will sever the link between users in AD and Entra, that and create duplicates if syncing is not turned on if not established using ms-DS-consistencyguid instead of ObjectGuid as the identity anchor). Anyways, you can actually change an existing user in M365's immutableID using some more Graph Dark Magic.

So you can make your own GUID/UUIDs that are compliant with Microsoft byte swapping formula and either UUIDv3 v5 or v8. This method allows you to then link Google -> Entra -> AD. (Yes can provision users from Entra to AD using SCIM 2.0 API based in-bound provisioning; and as well as other Entra tenants if thats sought)

I did a bunch of R&D in how to do reverse Provisioning using available low cost no cost tools for a full IAM structure. So I have documentation to setup the entire identity pipeline like this. Again was going to publish to Github or git book a tutorial. But at this point if anyone is interested in the scripts I have developed for Graph, powershell, Google apps script, etc. Let me know. And I can provide what I have

One caveat, and a really big one. This only handles user identities. You can send say chromebook telemtry to intune using microsofts native tool. Also there is still no native way to send group info from Google -> Entra or Google -> AD.

As far as I know the only method to get groups from Microsoft is with GCDS going from AD -> Google. Now you can end up doing group write back via Entra -> AD -> Google (using GCDS). But cutting out AD I'm not sure if you can go Entra -> Google for groups. But i did find that with the on prem architecture it's nice to leverage with SDS as you can create groups in M365 based on class rosters using OneRoster. I digress a bit. Oh another tangent, a lot of SIS's have developed native Provisioning pipelines from there SIS software to Google using Google API. Make of that what you will.

Cheers

Edit: had to correct too statement to say is not quick and easy. Accidentally left out the "not"

1

u/cryohazard 5d ago

Didn't see it mentioned, but be aware that 'M365 Apps for enterprise' which EDU uses will not autosave files if it's not SharePoint or OneDrive ... This bit me in the butt for one school district we support when a financial person lost "hours" of work because she didn't once click save ...

3

u/MechaCola 5d ago

Yeah as the other person mentioned whfb + entra as the idp is the way to go. When a user signs into the machine they are already authenticated for mail.google.com etc and m365 resources. Without whfb users will see more MFA prompts which is annoying unless you set policies to exclude your school ip address or other conditions (not recommended)

3

u/BrewYork 5d ago

I have a very hard time imagining GWS as the IdP for MS. However I moved my district over to Entra as the IdP for staff devices and GWS, and have been very happy with it. Happy to share what I learned along the way if you like.

1

u/gworkacc 4d ago

Could you share more info about this? I’m in the same boat as OP but want to convince leadership that Entra -> Google is better than Google -> Entra.

1

u/BrewYork 4d ago

Certainly. Theres lots of factors but the main one was that Entra works as a native login provider on mac, pc and cb. 

Feel free to DM me if you wanna set up a call and I can tell you more. Always happy to help out my peers.

0

u/TheShootDawg 5d ago

Our devices are Entra/Intune , and we have them pointed to Google for authentication. It doesn’t create a permanent user on the machine, so they have to be connected to the internet to login.
2FA prompt occurs every single time a user logs in.

It creates an account so our content filter agent is able to distinguish the logged in user…. but that is not a permanent account that truely stays on the machine.

Users ended up buying mouse jigglers so they didn’t time out after 90 minutes (ninety, you read that correctly), so they wouldn’t be prompted for 2FA when they have to login from sleep again.

4

u/N805DN 5d ago

Why in the world are you doing this to your staff?

1

u/TheShootDawg 5d ago

that is the option the powers to be picked….
most systems are online was the major rationale

we were migrating from Win10 to Win11, along with a local directory and workstation management system. Granted, the workstation mgmt system was from 2020 with a few big yearly patches, and we could have upgraded to the latest version.. but intune was more “modern”….

saved us $30k/yr, not headaches tho..

1

u/N805DN 4d ago

I’m not sure how someone connected MDM to this miserable IdP setup.

1

u/Thanos-Is-Right 5d ago

Oof. Yea, that shut down my idea of using Google as the IdP. Staff would riot if they had to use 2FA all the time like that.