• Home
• App Integrations
• Single Sign-On (SSO) Integrations
• Outlook Web Access (OWA) Single Sign-On (SSO)

Outlook Web Access (OWA) and on-premises Exchange Single Sign-On (SSO) using Microsoft Entra

---

Outlook Web Access (OWA) SSO (Single Sign-On) solution by miniOrange provides seamless SSO to your Outlook Web Access (OWA) Application and on-premises Exchange server for secure SSO login. With miniOrange’s OWA SSO configuration, your users will be able to login to Outlook Web Access (OWA) and other SaaS or on-premises applications with your existing IDP credentials. miniOrange’s Outlook web access SSO provides IDP integration with ADFS, Okta, Onelogin, Microsoft Azure Active Directory, AWS Cognito etc. You can also connect miniOrange’s solution with Active Directory, LDAP, Google or use miniOrange as your directory in the cloud. We support multiple protocols like SAML,OAuth, LDAP, OIDC etc.

miniOrange and Outlook Web Access (OWA) Single Sign-On (SSO) integration supports the following features:

• SP (Service Provider) Initiated Single Sign-On (SSO)

In this flow, the user tries to login to the Service Provider (On-Premises Exchange OWA Outlook Web Access account) directly. The request is redirected to the Identity Provider (Microsoft Entra, etc.) for authentication. On sucessfull authentication from the Identity provider, the user is given access to the application (OWA account).



• IdP (Identity Provider) Initiated Single Sign-On (SSO)

In this flow, the user logs in to the Identity Provider (Microsoft Entra, etc.) using his credentials. Now the user can access any of the configured Service Providers (OWA account, etc.) through the Identity Provider Dashboard without having to enter the credentials agian.

Prerequisites

• All plans are required to do the single sign-on (SSO) configuration.

Follow the step-by-step guide given below for Outlook Web Access (OWA) Single Sign-On (SSO)

1. Configure Exchange in miniOrange IdP

• Login into miniOrange dashboard from the Admin Console.
• From the left side menu, click on Apps → Manage Apps.



• Click on Add Application button.



• In choose application type, click on create app button in SAML/WS-FED application type.



• In the next step, search for your application from the list, if your application is not found. Search for "custom" and you can set up your app via Custom WS-Fed App.



• Enter the following information in the respective fields.
• Custom Application Name: Outlook Web access Owa
• WT-Realm: https://{owa-url} e.g. https://mail.example.com/owa
• Reply URL: https://{owa-url} e.g. https://mail.example.com/owa
• Set WS-Fed validity period: 300s



• Under Attribute Mapping section, enter the following attributes as shown below:



• Click on Save.

2. Configure Exchange / OWA for Sign-On using miniOrange

• After saving the app, go to Apps and click on Select >> Metadata against the app saved.



• Select Show Metadata Details to reveal the details shown in the image below.



• Copy the WS-Federation Reply URL and download the X.509 Certificate.
• Add above certificate (obtained in above step) to the Trusted People store on the Exchange Server using the steps below:
• Got to Management Console. Open run dialog (Win + R) and type mmc and press enter.
• In Management Console, go to File > Add or Remove Snap-ins (Ctrl + M).
• Search for Certificates on the left side and press Add.
• In the Certificate Snap In window, select Computer account and press Next. Then select Local Computer and press Finish.
• You will see an entry for Certificates (Local Computer) in the right pane. Click OK to close the Add or Remove Snap-ins window.
• You will see a branch named Certificates created under Console Root. Expand the Certificates branch and select Trusted People.
• Right click on Trusted People > Find > Import and click on Next.
• Choose the location of the downloaded certificate file you created above and click on Next, again Next and Finish.
• You have successfully added a Signing Certificate to Trusted People. Now close Management Console and choose No on the Save data prompt.

• Execute the commands below on the Exchange Server using the Exchange Management Shell.
• In the below command, ##Base URL## is the exchange/OWA host. The command has both URLs: One ending in / and the other one which does not contain a trailing slash.
  $uris=@("https://##Base URL##/owa/","https://##Base URL##/ecp/","https://##Base URL##/owa","https://##Base URL##/ecp")
  
• In the below command, the ##miniOrange URL## is the WS-Federation Reply URL. The Cert Thumbprint is the SHA-1 thumbprint of the certificate you downloaded.

  Note: Make sure the certificate thumb print is in uppercase.

  
  Set-OrganizationConfig -AdfsIssuer "##miniOrange URL##" -AdfsAudienceUris $uris -AdfsSignCertificateThumbprint ##Cert Thumbprint##
Get-EcpVirtualDirectory | Set-EcpVirtualDirectory -AdfsAuthentication $true -BasicAuthentication $false -DigestAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false
Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -AdfsAuthentication $true -BasicAuthentication $false -DigestAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false -OAuthAuthentication $false
# Restart w3svc and was net stop was /y net start w3svc

3. Test SSO Configuration

• Login to your OWA account.
• You will be redirected to miniOrange IdP Sign On page.



• Enter your miniOrange login credential and click on Login. You will be automatically logged in to your account.

External References

• Know More about Single Sign-On (SSO)
• Read more about SAML SSO
• Enable Single sign-on (SSO) for Microsoft Sharepoint online
• Check out more about Microsoft Single sign-on (SSO) & 2FA
  

FAQ