Test Apps

for a user not in SRO (current default case for live users)

• Application redirects to CoSign for Authentication
• CoSign authenticates user
• Cosign redirects user to application

for a user in SRO (interim state after user migration, but before application migration)

• Application redirects to CoSign for Authentication
• CoSign forwards user to Entra for authentication
• Entra authenticates user (quirk: Entra registration requires member user)
• Entra redirects user to CoSign
• Cosign redirects user to application

Right now, we don't direct friend users via the staged rollout path, but we could.
TODO: Allow friend users to be directed to Entra, as if they were in staged rollout

user not in SRO (only intended for O365)

• Application redirects to Entra for Authentication
• Entra redirects user to Shib IdP for Authentication (federated logon)
• Shib IdP forwards user to Cosign for Authentication
• CoSign authenticates user
• CoSign redirects user to Shib IdP
• Shib IdP redirects user to Entra
• Entra redirects user to Application

• "stay signed in?" at all Entra logins (fixed?)
  FIXED 20260601:Identity>Users>Settings>"keep user signed in=no"
• "Let's keep your account secure" at first Entra Login
  FIXED 20260604: mfasync needs to set default-mfa-method (or perhaps PreferredMfaMethod)
• handling of friend/external users:
  DONE 20260626 - 'any' versions allow external users, 'non-any' versions disallow external users
• Friend users: look at applying SRO mechanism to them
  DONE 20260630 - just add external users into SRO group
• Demonstration of requesting/accepting use of MFA
  20260627 uses separate app registrations for 'mfa' vs non-mfa
• Entra App registrations ('*_any' registrations done 20260624)
  14d8e306-4e4e-44c5-bacd-8e71e58a5974: "WebLogin PoC"
  b4fe0dcd-9ad4-4f0f-b872-c53d4bab5586: "WebLogin PoC (MFA): Ent Apps>'bfe0...'>Manage>Custom security attributes>ConditionalAccessTest
  2f1d5251-5c04-42bb-b06f-c42a362218bf: WebLogin PoC (any user) : set supported accounts="any tenant"
  fd5a15b6-79a0-462b-bbcb-be29d25143ea: WebLogin PoC (MFA+any user) : is this needed?
• **per-app branding** can maybe use this to ease deployment of new theme without affecting O365 login page
  test by applying a different theme to one of the WebLogin apps

  July

  add app-specific branding for WebLogin endpoints

  September

  add app-specific branding for O365

  October

  update default branding to match new approved theme

  After rollout

  remove app-specific branding for WebLogin