• Home
• App Integrations
• Single Sign-On (SSO) Integrations
• Outlook Web Access (OWA) Single Sign-On (SSO)

Configure Single Sign-On (SSO) for Outlook Web Access (OWA) and On-Premises Exchange

---

Secure your Outlook Web Access (OWA) and on-premises Exchange with an easy and reliable Single Sign-On (SSO) product from miniOrange. With this, your users only need to remember one set of login details to access OWA and other applications, making their experience smoother and more secure.

OWA single sign-on works with your existing Identity Providers (IDPs), like Microsoft Azure AD, ADFS, Okta, and others. This guide will help you set up OWA SSO step-by-step, so you can simplify access, reduce the hassle of multiple passwords, and make logging in faster for everyone.

miniOrange supports two easy ways to log in to your OWA account using SSO:

• Service Provider (SP) Initiated SSO

You start by trying to log in directly to your OWA and on-premise Exchange account. Your login request is then securely redirected to your Identity Provider (like Microsoft Entra) for verification. Once you successfully authenticate there, you’ll be logged into your OWA account without needing to enter your credentials again.



• Identity Provider (IdP) Initiated SSO

Here, you first log in to your Identity Provider (such as Microsoft Entra) using your credentials. After that, you can easily access your OWA and other connected apps from your Identity Provider dashboard without having to log in again for each service.

Prerequisites

• All plans are required to do the single sign-on (SSO) configuration.

Follow the step-by-step guide given below for Outlook Web Access (OWA) Single Sign-On (SSO)

1. Configure Exchange in miniOrange IdP

• Login into miniOrange dashboard from the Admin Console.
• Go to Apps and click on Add Application button.



• In Choose Application Type click on Create App button in SAML/WS-FED application type.



• In the next step, search for your application from the list, if your application is not found. Search for "custom" and you can set up your app via Custom WS-Fed App.



• Enter the following information in the respective fields.
• Custom Application Name: Outlook Web access Owa
• WT-Realm: https://{owa-url} e.g. https://mail.example.com/owa
• Reply URL: https://{owa-url} e.g. https://mail.example.com/owa
• Set WS-Fed validity period: 300s



• Under Attribute Mapping section, enter the following attributes as shown below:



• Click on Save.

2. Configure Exchange / OWA for Sign-On using miniOrange

• After saving the app, go to Apps and click on the icon ' ' >> Metadata against the app saved.



• Select Show Metadata Details to reveal the details shown in the image below.



• Copy the WS-Federation Reply URL and download the X.509 Certificate.
• Add above certificate (obtained in above step) to the Trusted People store on the Exchange Server using the steps below:
• Got to Management Console. Open run dialog (Win + R) and type mmc and press enter.
• In Management Console, go to File > Add or Remove Snap-ins (Ctrl + M).
• Search for Certificates on the left side and press Add.
• In the Certificate Snap In window, select Computer account and press Next. Then select Local Computer and press Finish.
• You will see an entry for Certificates (Local Computer) in the right pane. Click OK to close the Add or Remove Snap-ins window.
• You will see a branch named Certificates created under Console Root. Expand the Certificates branch and select Trusted People.
• Right click on Trusted People > Find > Import and click on Next.
• Choose the location of the downloaded certificate file you created above and click on Next, again Next and Finish.
• You have successfully added a Signing Certificate to Trusted People. Now close Management Console and choose No on the Save data prompt.

• Execute the commands below on the Exchange Server using the Exchange Management Shell.
• In the below command, ##Base URL## is the exchange/OWA host. The command has both URLs: One ending in / and the other one which does not contain a trailing slash.
  $uris=@("https://##Base URL##/owa/","https://##Base URL##/ecp/","https://##Base URL##/owa","https://##Base URL##/ecp")
  
• In the below command, the ##miniOrange URL## is the WS-Federation Reply URL. The Cert Thumbprint is the SHA-1 thumbprint of the certificate you downloaded.

  Note: Make sure the certificate thumb print is in uppercase.

  
  Set-OrganizationConfig -AdfsIssuer "##miniOrange URL##" -AdfsAudienceUris $uris -AdfsSignCertificateThumbprint ##Cert Thumbprint##
Get-EcpVirtualDirectory | Set-EcpVirtualDirectory -AdfsAuthentication $true -BasicAuthentication $false -DigestAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false
Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -AdfsAuthentication $true -BasicAuthentication $false -DigestAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false -OAuthAuthentication $false
# Restart w3svc and was net stop was /y net start w3svc

3. Test SSO Configuration

• Login to your OWA account.
• You will be redirected to miniOrange IdP Sign On page.



• Enter your miniOrange login credential and click on Login. You will be automatically logged in to your account.

FAQs

External References

• Know More about Single Sign-On (SSO)
• Read more about SAML SSO
• Enable Single sign-on (SSO) for Microsoft Sharepoint online
• Check out more about Microsoft Single sign-on (SSO) & 2FA