无本地环境下，如何将Office365 Exchange与Azure AD同步实现SSO？

Got it, let's walk through this step by step—since you don't have any on-prem infrastructure, this is totally doable with Microsoft's cloud-native tools, and it's simpler than you might think.

First, a key point to clarify: Your Office 365 Exchange Online users are already stored in Azure Active Directory (Azure AD). Office 365 is built on top of Azure AD, so you don't need to sync users manually. That's a huge win here.

Here's the playbook:

1. Link your Azure subscription to your Office 365 Azure AD tenant #

If your Azure subscription was created separately (not through the Office 365 portal), it might belong to a separate Azure AD tenant. You need to tie it to your Office 365 tenant so both services share the same identity source:

• Log into the Azure portal using the admin account for your existing Azure subscription.
• Search for and open the Subscriptions page, then select the subscription you want to link.
• In the left menu, under Resource access management, click Change directory.
• From the dropdown, pick your Office 365 Azure AD tenant (it'll match your company domain, like mycompany.com), then follow the prompts to finish the link.

Heads up: This requires "Owner" permissions on the Azure subscription, and you can't undo it right away—double-check before proceeding.

2. Confirm Exchange users exist in Azure AD #

Once the tenant link is done, verify your Exchange users are already in Azure AD:

• In the Azure portal, search for and open Azure Active Directory.
• Click Users in the left menu—you should see all the users you created in Exchange Online (like user@mycompany.com).

If a user is missing, check their status in Exchange Online first, then wait a few minutes (sync is almost instant, but rare delays happen).

3. Let Exchange users sign into the Azure portal #

Your users can now log into the Azure portal using their Exchange credentials right away:

• Have them go to portal.azure.com, enter their Exchange email (user@mycompany.com), and input their existing password.
• First-time sign-ins might require setting up multi-factor authentication (MFA) if your tenant has it enabled—this is highly recommended for security, so walk them through that prompt if needed.

4. Assign Azure resource management permissions to specific users #

To give certain users access to manage Azure resources, use Azure's built-in role-based access control (RBAC):

• Log into the Azure portal with your Office 365 global admin or Azure subscription owner account.
• Choose the resource you want to grant access to (e.g., a resource group, SQL database, or storage account), or assign tenant-wide roles via Azure Active Directory > Roles and administrators.
• For a resource group example: Open the target resource group, click Access control (IAM) in the left menu.
• Click Add > Add role assignment.
• Pick a role that fits the user's needs (e.g., "Contributor" lets them manage resources but not change permissions; "Owner" gives full control).
• In the Members tab, search for and select the Exchange user(s) you want to authorize, then click Review + assign to finalize.

Quick best practices to keep in mind #

• Least privilege principle: Only give users the minimum permissions they need to do their job—avoid handing out "Owner" roles unless absolutely necessary.
• Enforce MFA: Mandate MFA for all users, especially those with resource management access. It's one of the easiest ways to prevent unauthorized access.
• Monitor activity: Use Azure AD's Sign-in logs and Azure's Activity logs to keep an eye on user sign-ins and resource changes, so you can spot anomalies early.

内容的提问来源于stack exchange，提问作者goosseno