Federal Migration Guide: Active Directory to Entra ID¶

# Azure Government endpoints for identity
$endpoints = @{
    "Entra ID Login"         = "login.microsoftonline.us"
    "Graph API"              = "graph.microsoft.us"
    "Entra Admin Center"     = "entra.microsoft.us"
    "Intune"                 = "manage.microsoft.us"
    "Azure Portal"           = "portal.azure.us"
    "Key Vault"              = "vault.usgovcloudapi.net"
    "Storage"                = "blob.core.usgovcloudapi.net"
}

# Connect to Azure Government Entra ID
Connect-MgGraph -Environment USGov -Scopes "Directory.Read.All"

# Or via Azure CLI
az cloud set --name AzureUSGovernment
az login --tenant "your-gov-tenant-id"

# Step 1: Upload federal CA certificate chain
Connect-MgGraph -Environment USGov -Scopes "Policy.ReadWrite.AuthenticationMethod"

# Upload DoD Root CA certificates
$rootCAs = @(
    @{
        Certificate = [Convert]::ToBase64String(
            [IO.File]::ReadAllBytes(".\DoD-Root-CA-6.cer")
        )
        IsRootAuthority = $true
        CertificateRevocationListUrl = "http://crl.disa.mil/crl/DODROOTCA6.crl"
    },
    @{
        Certificate = [Convert]::ToBase64String(
            [IO.File]::ReadAllBytes(".\DoD-ID-CA-73.cer")
        )
        IsRootAuthority = $false
        CertificateRevocationListUrl = "http://crl.disa.mil/crl/DODIDCA_73.crl"
        DeltaCertificateRevocationListUrl = "http://crl.disa.mil/crl/DODIDCA_73_delta.crl"
    }
)

# Step 2: Configure CBA authentication method
$cbaConfig = @{
    "@odata.type" = "#microsoft.graph.x509CertificateAuthenticationMethodConfiguration"
    state = "enabled"
    certificateUserBindings = @(
        @{
            x509CertificateField = "PrincipalName"
            userProperty = "onPremisesUserPrincipalName"
            priority = 1
        },
        @{
            x509CertificateField = "RFC822Name"
            userProperty = "userPrincipalName"
            priority = 2
        }
    )
    authenticationModeConfiguration = @{
        x509CertificateAuthenticationDefaultMode = "x509CertificateMultiFactor"
        rules = @(
            @{
                x509CertificateRuleType = "issuerSubject"
                identifier = "CN=DOD ID CA-73"
                x509CertificateAuthenticationMode = "x509CertificateMultiFactor"
            }
        )
    }
}

Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `
    -AuthenticationMethodConfigurationId "x509Certificate" `
    -BodyParameter $cbaConfig

# Generate FedRAMP identity control evidence

# AC-2: Account Management evidence
$users = Get-MgUser -All -Property CreatedDateTime, AccountEnabled,
    OnPremisesSyncEnabled, AssignedLicenses |
    Select-Object UserPrincipalName, CreatedDateTime, AccountEnabled,
    @{N="LicenseCount"; E={$_.AssignedLicenses.Count}}

$users | Export-Csv ".\fedramp-evidence\ac-2-user-inventory.csv" -NoTypeInformation

# IA-2: Authentication Method evidence
$authMethods = Get-MgReportAuthenticationMethodUserRegistrationDetail -All
$authMethods | Select-Object UserPrincipalName, MethodsRegistered,
    IsMfaRegistered, IsMfaCapable, IsPasswordlessCapable |
    Export-Csv ".\fedramp-evidence\ia-2-mfa-registration.csv" -NoTypeInformation

# AU-6: Audit Review evidence (sign-in summary)
$signIns = Get-MgAuditLogSignIn -Filter "createdDateTime ge 2026-04-01" -All
$signIns | Group-Object Status.ErrorCode | Select-Object Name, Count |
    Export-Csv ".\fedramp-evidence\au-6-sign-in-summary.csv" -NoTypeInformation

# Federal Conditional Access: Require phishing-resistant MFA
$fedPolicy = @{
    displayName = "FED-CA001 - Require Phishing-Resistant MFA"
    state = "enabledForReportingButNotEnforced"
    conditions = @{
        users = @{
            includeUsers = @("All")
            excludeUsers = @("BreakGlass1-Id", "BreakGlass2-Id")
        }
        applications = @{ includeApplications = @("All") }
    }
    grantControls = @{
        operator = "OR"
        authenticationStrength = @{
            id = "00000000-0000-0000-0000-000000000004"  # Phishing-resistant MFA
        }
    }
}

New-MgIdentityConditionalAccessPolicy -BodyParameter $fedPolicy

# Verify tenant is in Azure Government
$org = Get-MgOrganization
$org | Select-Object DisplayName, TenantType,
    @{N="Cloud"; E={$_.VerifiedDomains[0].Name}},
    CountryLetterCode

# Azure Government tenants have specific service endpoints
# that are isolated from commercial Azure