• Home
• App Integrations
• Single Sign-On (SSO) Integrations
• Outlook Web Access (OWA) Single Sign-On (SSO)

Configure Single Sign-On (SSO) for Outlook Web Access (OWA) and On-Premises Exchange

---

Secure your Outlook Web Access (OWA) and on-premises Exchange with an easy and reliable Single Sign-On (SSO) product from miniOrange. With this, your users only need to remember one set of login details to access Exchange and other applications, making their experience smoother and more secure.

Exchange single sign-on works with your existing Identity Providers (IDPs), like Microsoft Azure AD, ADFS, Okta, and others. This guide will help you set up Exchange SSO step-by-step, so you can simplify access, reduce the hassle of multiple passwords, and make logging in faster for everyone.

miniOrange supports two easy ways to log in to your Exchange account using SSO:

• Service Provider (SP) Initiated SSO:

  You start by trying to log in directly to your OWA and on-premise Exchange account. Your login request is then securely redirected to your Identity Provider (like Microsoft Entra) for verification. Once you successfully authenticate there, you’ll be logged into your OWA account without needing to enter your credentials again.

• Identity Provider (IdP) Initiated SSO:

  Here, you first log in to your Identity Provider (such as Microsoft Entra) using your credentials. After that, you can easily access your OWA and other connected apps from your Identity Provider dashboard without having to log in again for each service.

Prerequisites

All plans are required to do the single sign-on (SSO) configuration.

Follow the step-by-step guide given below for Exchange Single Sign-On (SSO)

1. Configure Exchange in miniOrange IdP

• Login into miniOrange dashboard from the Admin Console.
• Go to Apps and click on Add Application button.



• In Choose Application Type, select SAML/WS-FED from the All Apps dropdown.



• Next, search for Exchange and select the Exchange app.

  To be released soon.




• In the Basic tab, enter the following information:

  Display Name	Exchange
  WT-Realm	https://{owa-url} (e.g., https://mail.example.com/owa)
  Reply URL	https://{owa-url} (e.g., https://mail.example.com/owa)
  WS-FED Validity Period	300s




• Click Next to go to the Attributes tab. Enter the following attributes as shown below:



• Click Save to add the application.

2. Configure Exchange / OWA for Sign-On using miniOrange

• Go to Apps >> Applications.
• Search for your app and click the three-dot icon in the Actions column, then select Metadata.



• After selecting Metadata, you will be redirected to the Metadata tab. View the details as shown below:



• Copy the WS-Federation Reply URL and Download Certificate.
• Add above certificate (obtained in above step) to the Trusted People store on the Exchange Server using the steps below:
• Go to Management Console. Open run dialog (Win + R) and type mmc and press enter.
• In Management Console, go to File > Add or Remove Snap-ins (Ctrl + M).
• Search for Certificates on the left side and press Add.
• In the Certificate Snap In window, select Computer account and press Next. Then select Local Computer and press Finish.
• You will see an entry for Certificates (Local Computer) in the right pane. Click OK to close the Add or Remove Snap-ins window.
• You will see a branch named Certificates created under Console Root. Expand the Certificates branch and select Trusted People.
• Right click on Trusted People > Find > Import and click on Next.
• Choose the location of the downloaded certificate file you created above and click on Next, again Next and Finish.
• You have successfully added a Signing Certificate to Trusted People. Now close Management Console and choose No on the Save data prompt.
• Execute the commands below on the Exchange Server using the Exchange Management Shell.
• In the below command, ##Base URL## is the exchange/OWA host. The command has both URLs: One ending in / and the other one which does not contain a trailing slash. $uris=@("https://##Base URL##/owa/","https://##Base URL##/ecp/","https://##Base URL##/owa","https://##Base URL##/ecp")
• In the below command, the ##miniOrange URL## is the WS-Federation Reply URL. The Cert Thumbprint is the SHA-1 thumbprint of the certificate you downloaded.

  Note: Make sure the certificate thumb print is in uppercase.

  Set-OrganizationConfig -AdfsIssuer "##miniOrange URL##" -AdfsAudienceUris $uris -AdfsSignCertificateThumbprint ##Cert Thumbprint##
Get-EcpVirtualDirectory | Set-EcpVirtualDirectory -AdfsAuthentication $true -BasicAuthentication $false -DigestAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false
Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -AdfsAuthentication $true -BasicAuthentication $false -DigestAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false -OAuthAuthentication $false
# Restart w3svc and was net stop was /y net start w3svc

3. Test SSO Configuration

• Login to your Exchange account.
• You will be redirected to miniOrange IdP Sign On page. Enter your miniOrange login credential and click on Login. You will be automatically logged in to your account.

Manage Exchange Devices

To be released soon.

The Manage Exchange Devices feature allows administrators to control which devices are permitted to access the Exchange application.

Accessing the Manage Exchange Devices Page

• Navigate to the Application in the dashboard.
• Click on the Actions menu associated with the Exchange app.
• Select Manage Exchange Devices from the dropdown menu.

The Manage Exchange Devices page displays a list of devices that are attempting to access the Exchange/ActiveSync application. Administrators can review each device and decide whether it should be allowed or denied access.

Device States

Each device will have a status indicating its current access state:

Requested (Default State)	When a device attempts to access the Exchange application for the first time, it will appear with the status Requested. This means the device is awaiting administrator approval.
Allowed	Devices marked as Allowed are permitted to access the Exchange application.
Denied	Devices marked as Denied are blocked from accessing the Exchange application.

Managing Device Access

Administrators can update the status of a device by selecting the appropriate action:

Allow	Grants the device permission to access the Exchange application.
Deny	Blocks the device from accessing the Exchange application.

This feature helps maintain security by ensuring that only authorized devices can access the Exchange environment.

FAQs

External References

• Know More about Single Sign-On (SSO)
• Read more about SAML SSO
• Enable Single sign-on (SSO) for Microsoft Sharepoint online
• Check out more about Microsoft Single sign-on (SSO) & 2FA