DUO SSO to Entra ID: External Authentication Methods

Question

DUO SSO to Entra ID: External Authentication Methods

ROY TRUE 0

We currently use DUO SSO with ENTRA ID. We need to defederate our domain to allow for Entra ID: External Authentication Methods which is already setup in DUO to take over when we disable DUO SSO. I have instructions on how to defederate our domain. However, I would like further input on the do's and don'ts.

Carolyne 1,151 Reputation points Microsoft Employee

2026-01-28T20:06:11.0033333+00:00

Hello Roy!
Ideally when moving the key do is to fully validate Entra cloud authentication first (password hash sync or cloud auth) and test Duo EAM with a pilot group before defederating the domain, as users will authenticate directly against Entra once the domain is set to Managed. Avoid defederating without confirmed fallback access (break‑glass accounts and non‑EAM MFA) and expect a short propagation window where sign‑ins may intermittently fail during the federated→managed switch.

Your answer

Carolyne 1,151 Reputation points Microsoft Employee

2026-01-28T20:06:11.0033333+00:00

Hello Roy!
Ideally when moving the key do is to fully validate Entra cloud authentication first (password hash sync or cloud auth) and test Duo EAM with a pilot group before defederating the domain, as users will authenticate directly against Entra once the domain is set to Managed. Avoid defederating without confirmed fallback access (break‑glass accounts and non‑EAM MFA) and expect a short propagation window where sign‑ins may intermittently fail during the federated→managed switch.