SSO Application Migration: Okta to Entra ID¶

# Step 1: Find the gallery application template
$templates = Get-MgServicePrincipal -Filter "tags/Any(t: t eq 'WindowsAzureActiveDirectoryGalleryApplicationNonOpenIdConnect')" `
  -CountVariable count -Top 50

# Search for specific app (e.g., Salesforce)
$salesforceTemplate = Get-MgApplicationTemplate -Filter "displayName eq 'Salesforce'"

# Step 2: Create enterprise application from gallery template
$app = New-MgApplicationFromTemplate -ApplicationTemplateId $salesforceTemplate.Id -DisplayName "Salesforce"

# Step 3: Configure SAML SSO
$params = @{
    preferredSingleSignOnMode = "saml"
}
Update-MgServicePrincipal -ServicePrincipalId $app.ServicePrincipal.Id -BodyParameter $params

# Step 1: Create non-gallery enterprise application
$appRegistration = New-MgApplication -DisplayName "Custom App - SAML"

# Step 2: Create service principal
$sp = New-MgServicePrincipal -AppId $appRegistration.AppId

# Step 3: Set preferred SSO mode to SAML
Update-MgServicePrincipal -ServicePrincipalId $sp.Id -PreferredSingleSignOnMode "saml"

# Step 4: Configure SAML SSO settings via Graph API
$samlConfig = @{
    "identifierUris" = @("https://custom-app.contoso.com")
    "web" = @{
        "redirectUris" = @("https://custom-app.contoso.com/saml/acs")
    }
}
Update-MgApplication -ApplicationId $appRegistration.Id -BodyParameter $samlConfig

# Generate new SAML signing certificate in Entra
$certParams = @{
    displayName = "Custom App SAML Signing Certificate"
    type = "AsymmetricX509Cert"
    usage = "Sign"
    key = @{
        usage = "Sign"
        type = "AsymmetricX509Cert"
    }
}

# Add certificate credential to service principal
Add-MgServicePrincipalTokenSigningCertificate -ServicePrincipalId $sp.Id

# Download federation metadata for the app to configure in the SP
# URL format: https://login.microsoftonline.com/{tenant-id}/federationmetadata/2007-06/federationmetadata.xml?appid={app-id}

# Step 1: Register application in Entra ID
$app = New-MgApplication -DisplayName "My OIDC App" -SignInAudience "AzureADMyOrg" -Web @{
    RedirectUris = @(
        "https://myapp.contoso.com/auth/callback",
        "https://myapp.contoso.com/auth/silent"
    )
}

# Step 2: Create client secret (or configure certificate)
$secret = Add-MgApplicationPassword -ApplicationId $app.Id -PasswordCredential @{
    DisplayName = "Migration secret"
    EndDateTime = (Get-Date).AddYears(1)
}

# Step 3: Configure API permissions (scopes)
# Map Okta custom scopes to Entra permissions
Add-MgApplicationApiPermission -ApplicationId $app.Id -ApiId "00000003-0000-0000-c000-000000000000" -Scope @{
    Id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"  # User.Read
    Type = "Scope"
}

# Step 4: Output new configuration for application team
Write-Host "Client ID: $($app.AppId)"
Write-Host "Client Secret: $($secret.SecretText)"
Write-Host "Tenant ID: $(Get-MgContext | Select-Object -ExpandProperty TenantId)"
Write-Host "Authority: https://login.microsoftonline.com/$(Get-MgContext | Select-Object -ExpandProperty TenantId)"
Write-Host "Token Endpoint: https://login.microsoftonline.com/$(Get-MgContext | Select-Object -ExpandProperty TenantId)/oauth2/v2.0/token"

# Create enterprise application with password-based SSO
$app = New-MgApplication -DisplayName "Legacy SWA App" -Web @{
    HomePageUrl = "https://legacy-app.contoso.com/login"
}
$sp = New-MgServicePrincipal -AppId $app.AppId
Update-MgServicePrincipal -ServicePrincipalId $sp.Id -PreferredSingleSignOnMode "password"

# Configure sign-in URL for password capture
Update-MgServicePrincipal -ServicePrincipalId $sp.Id -LoginUrl "https://legacy-app.contoso.com/login"

# Generate test SAML assertion (for debugging)
# Use the Entra admin center: Enterprise Applications > {app} > Single sign-on > Test

# Validate SAML configuration
$sp = Get-MgServicePrincipal -Filter "displayName eq 'Custom App'"
$samlSettings = Get-MgServicePrincipalSamlSingleSignOnSetting -ServicePrincipalId $sp.Id

# Check sign-in logs for the application
$signInLogs = Get-MgAuditLogSignIn -Filter "appId eq '$($sp.AppId)' and status/errorCode ne 0" -Top 10

if ($signInLogs.Count -eq 0) {
    Write-Host "No authentication errors for $($sp.DisplayName)" -ForegroundColor Green
} else {
    Write-Host "Authentication errors detected:" -ForegroundColor Red
    $signInLogs | ForEach-Object {
        Write-Host "  User: $($_.UserPrincipalName), Error: $($_.Status.ErrorCode) - $($_.Status.FailureReason)"
    }
}