Microsoft 365

Protocol: SAML 2.0 Native feature: Microsoft Entra External Identities direct federation Estimated time: 30-45 minutes Reference docs: Microsoft Learn - Add a SAML/WS-Fed identity provider (direct federation) (opens in a new tab)

note

Distinct from LuxID Pro federation, which goes the other direction (Entra → LuxID, so corporate users authenticate to LuxID via Entra). For LuxID Pro, see Single sign-on and LuxID Pro.

Scope: This guide covers adding LuxID as a SAML federation partner for Entra External Identities (B2B direct federation). Users with LuxID Accounts can be invited as guests to your Microsoft 365 tenant and authenticate using LuxID instead of creating a Microsoft account.

This is not the same as replacing Microsoft's own Entra ID login for your internal users - that scenario is out of scope for LuxID.

Prerequisites

• Microsoft 365 tenant with Entra ID P1 or P2 licence (required for External Identities direct federation)
• Global Administrator or External Identity Provider Administrator role in Entra
• LuxID SAML metadata XML
• Your Entra tenant's ACS URL and Audience URI to provide to LuxID

Step 1 - locate external identities federation settings

In the Microsoft Entra admin centre (opens in a new tab):

Navigate to External Identities > All Identity Providers > + New SAML/WS-Fed IdP

Step 2 - gather your Entra SP details

Before configuring, note your tenant-specific values:

Entra field	Your value
Entity ID / Audience URI	urn:federation:MicrosoftOnline
ACS URL	https://login.microsoftonline.com/login.srf

Send these to LuxID so LuxID can register your Microsoft tenant as a Relying Party.

Step 3 - configure the SAML IdP in Entra

In the New SAML/WS-Fed IdP screen:

Entra field	Value to enter
Identity provider protocol	SAML
Domain of federating IdP	The email domain(s) of LuxID users you are federating (e.g. post.lu)
IdP Metadata URL (optional)	https://docs.luxid.lu/saml/luxid_idp_saml_metadata-prod.xml

If Entra cannot fetch the metadata URL directly, download the XML and upload it, or enter the following fields manually:

Entra field	Value from LuxID metadata
Issuer URI of IdP	https://login.luxid.lu/saml/sps/saml20idp-LUXID/saml20
Passive authentication URL	From metadata XML (SingleSignOnService with POST binding)
Certificate	From metadata XML (X509Certificate element)

Step 4 - claim mapping

Microsoft Entra External Identities expects specific SAML attributes to map the incoming LuxID user to a guest account:

Entra expected attribute	LuxID SAML attribute
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress	email
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname	given_name
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname	family_name
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	name

Confirm with LuxID that your Claim Template includes these attributes and that the attribute names match exactly.

Step 5 - test login

1. Invite a test LuxID user (using the LuxID UAT test account email) as a guest to your Microsoft 365 tenant
2. The invited user opens the invitation link
3. They should be redirected to login-uat.luxid.lu (or login.luxid.lu if not using UAT)
4. After authentication, they should land in the Microsoft 365 app they were invited to

Step 6 - production checklist and common errors

Production checklist

• Domain of federating IdP matches the actual email domain of LuxID users being federated
• LuxID team has confirmed the Microsoft tenant is registered as a Relying Party
• Guest invitation flow tested end-to-end with a real LuxID Account
• Confirm conditional access policies in Entra do not block external identities

Common errors

Error	Cause	Fix
AADSTS75011 - auth method mismatch	Entra expects a specific AuthnContextClassRef	Confirm with LuxID team that assurance level matches Entra's expectation
AADSTS50107 - federation not found	Email domain not matching configured federation domain	Verify the domain field in Entra matches the user's email domain exactly
Certificate validation error	Expired or wrong certificate in Entra	Re-import the LuxID metadata XML to refresh the certificate
User prompted to create Microsoft account	Federation not triggered for that email domain	Check that the email domain is listed in the federation configuration