Facing Issues with MSOLService Deprecation — Best Practice for Azure SSO with OpenIAM?

Customer IAM (CIAM) SSO
1

Hi everyone,

I’m working on integrating OpenIAM with Microsoft Entra ID (Azure AD) for SAML SSO.
The OpenIAM documentation still references using Connect-MsolService for some parts of the setup, but as you know, MSOL PowerShell is now deprecated, and my tenant has security defaults/modern auth, so MSOL calls fail with Access Denied.

Here’s my situation:

  • OpenIAM is the IdP — Entra ID (Azure) is the SP.
  • I have a working SAML metadata and can import it in Azure.
  • My domain is verified, and I added the DirectFedAuthUrl TXT record properly.
  • The Connect-MsolService part keeps failing due to the deprecation.
  • I can connect with Microsoft Graph PowerShell (Connect-MgGraph works).

What I want:

  • When users authenticate via OpenIAM, they get SSO access to Azure services.
  • When I create or update user accounts or passwords, the changes sync to Entra ID reliably.
  • No legacy MSOL dependency — fully modern Graph API flow.

My questions for the community:

  1. Does anyone have a step-by-step for setting up SAML SSO with OpenIAM as IdP using only Microsoft Graph?
  2. Any custom connectors or Groovy scripts people have made to replace the MSOL calls with Graph API?
  3. How do you handle password writeback or syncing in this setup? Should I force OpenIAM to update AD and let AAD Connect handle the sync to Entra instead?

If you’ve done this with Graph only, please share:

  • Any working scripts
  • Updated connector config
  • Gotchas to watch for

I’m happy to test and share my results back with the community!

Thank you in advance — any tips would help a lot!

2

Hello Aaron,

Thank you for the post. I am checking with my team and will get back to you shortly.

Ameet

1 Like
3

Hello Aaron,

I will post the reply from one of our engineers below:
**
The client have to use Microsoft Graph PowerShell SDK
Install Microsoft.Graph module via PowerShell:
Install-Module Microsoft.Graph -Scope AllUsers

After installing Microsoft.Graph module, need connect to Azure with Administrator privileges
Connect-MgGraph -Scopes “Domain.ReadWrite.All”

Please follow Cmdlets:
Get-MgDomainFederationConfiguration -DomainId “openiamdemo.com” | Format-List * --Check if domain is federated
New-MgDomainFederationConfiguration
Update-MgDomainFederation

Soon we will update our documentation with using Microsoft Graph PowerShell SDK
**

Please let me know if you have any questions.

Thanks,
Ameet