How to make Google Apps iDP for Office 365
<p>I am trying to have our Google Apps users to sign in Office 365 with the Google credentials.</p>

<p>I am struggling with 2 things. </p>

<p><strong>1. setup a federated domain with Azure AD. Can anyone match the required variables from the Google iDP Meta data below?</strong></p>

<p>Below are the variables of Microsoft to set a federated domain from their help pages.</p>

<pre><code>$dom = "contoso.com" 
$BrandName - "Sample SAML 2.0 IDP" 
$LogOnUrl = "https://WS2012R2-0.contoso.com/passiveLogon" 
$LogOffUrl = "https://WS2012R2-0.contoso.com/passiveLogOff" 
$ecpUrl = "https://WS2012R2-0.contoso.com/PAOS" 
$MyURI = "urn:uri:MySamlp2IDP" 
$MySigningCert = @" MIIC7jCCAdag......NsLlnPQcX3dDg9A==" "@ 
$uri = "http://WS2012R2-0.contoso.com/adfs/services/trust" 
$Protocol = "SAMLP" 

Set-MsolDomainAuthentication ` -DomainName $dom -FederationBrandName $dom -Authentication Federated -PassiveLogOnUri $MyURI -ActiveLogOnUri $ecpUrl -SigningCertificate $MySigningCert -IssuerUri $uri -LogOffUri $url -PreferredAuthenticationProtocol $Protocol 
</code></pre>

<p>This is the Google iDP metadata where it suppose to have all the info</p>

<pre><code>&lt;?xml version="1.0" encoding="UTF-8" standalone="no"?&gt;
&lt;md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://accounts.google.com/o/saml2?idpid=C01gs" validUntil="2021-08-31T11:57:42.000Z"&gt;
  &lt;md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
    &lt;md:KeyDescriptor use="signing"&gt;
      &lt;ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
        &lt;ds:X509Data&gt;
          &lt;ds:X509Certificate&gt;MIIDdDCCAlygAwIBAgI
MTE1NzQyWhcNMjEwODM.....yVlPqeevZ6Ij
    f7LcIuZHffg1JV6pOB3A7afVp7JBbzZZOeuhl5nUhr96&lt;/ds:X509Certificate&gt;
        &lt;/ds:X509Data&gt;
      &lt;/ds:KeyInfo&gt;
    &lt;/md:KeyDescriptor&gt;
    &lt;md:NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress&lt;/md:NameIDFormat&gt;
    &lt;md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://accounts.google.com/o/saml2/idp?idpid=C02gs"/&gt;
    &lt;md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://accounts.google.com/o/saml2/idp?idpid=C03gs"/&gt;
  &lt;/md:IDPSSODescriptor&gt;
&lt;/md:EntityDescriptor&gt;
</code></pre>

<p><strong>2. After a successful federated domain (I succeeded, but it didn't work, so the variables I provided powershell was wrong). The admin portal for Office 365 does NOT allow one to add users from a federated domain. So, how to add users?</strong></p>

<p>Hope someone can help me with this puzzle.</p>