MagicEndpoint Integration with Microsoft 365: Overview & Architecture
Summary
This article explains the architecture, authentication model, and components involved when deploying MagicEndpoint as a delegated Identity Provider (IdP) for Microsoft Entra ID using WS‑Federation and WS‑Trust.
What is MagicEndpoint?
MagicEndpoint (ME) is a hardware‑backed authentication system that uses TPM‑based attestation to authenticate users silently after Windows unlock. Using SES and SD IdP, MagicEndpoint can act as the authoritative IdP for a hybrid Active Directory and Entra environment.
Key Components
SecureDoc Enterprise Server (SES) — central server, database, and IdP configuration host
SD IdP — WS‑Fed/WS‑Trust IdP endpoint
MagicEndpoint Agent — provides TPM‑based hardware identity and silent SSO
Microsoft Entra ID — service provider (SP) consuming ME tokens
How Authentication Works
Imagine a diagram with four components: User Device → SD IdP → Entra ID → Microsoft 365.
User unlocks Windows with PIN/biometric → ME establishes trust.
User accesses a cloud app (e.g., Outlook, Teams).
Entra ID redirects authentication to SD IdP (WS‑Fed or WS‑Trust).
SD IdP performs hardware attestation.
Signed assertion is returned to Entra ID.
User gains access with no password prompts.
Security Considerations
Maintain two non‑federated .onmicrosoft.com global admin accounts
Ensure ImmutableID consistency
Validate ADFS remnants if migrating
Confirm TPM 2.0 readiness
Whitelist ME AAGUID in Entra FIDO2 policies
Best Practices
Sync attributes before enabling federation
Validate SSO on a small pilot before rollout
Monitor SES Web logs for attestation failures
Avoid self‑signed certificates