Prerequisites

Make sure you have a valid subscription in Azure AD that handles the sign-in process and eventually provides the authentication credentials of subaccounts to the administrator console.

Setting up Azure Active Directory

1. Log in to the Azure AD Admin Center, then select an active directory that you want to implement SSO.
2. Click Enterprise applications in the navigation area on the left.

   

   ^{Click the image to enlarge.}

3. Click Add > Enterprise application.
4. On the Browse Azure AD Gallery screen, click Create your own application.
5. Specify a name for your application (e.g. Trend Micro Email Security Administrator Console).
6. Select Integrate any other application you don't find in the gallery (Non-gallery) and click Create.

   

   ^{Click the image to enlarge.}

7. Under the Getting Started section, click Assign users and groups.
8. Click Add user/group, specify the user or group for this application, click Select, and then click Assign.
    

   When needed, repeat the same steps to assign the application to more users.

    
9. In the navigation area of your application, click Single sign-on.
10. Click SAML to configure the connection from your application to Azure AD using the SAML protocol, then do the following:

    

    ^{Click the image to enlarge.}

    1. Configure the Basic SAML Configuration. Do the steps below:
       1. Under Basic SAML Configuration, click Edit.
       2. Specify the identifier and reply URL:
          • Identifier (Entity ID): https://ui.<domain_name>/uiserver/subaccount/ssoLogin
          • Reply URL (Assertion Consumer Service URL): https://ui.<domain_name>/uiserver/subaccount/ssoAssert?cmpID=<unique_identifier>
          • Replace <unique_identifier> with a unique identifier. Record the unique identifier, which will be used when you create an SSO profile on the Trend Micro Email Security administrator console.
          • Replace <domain_name> with any of the following based on your location:
            • North America, Latin America and Asia Pacific: tmes.trendmicro.com
            • Europe, the Middle East and Africa: tmes.trendmicro.eu
            • Australia and New Zealand: tmes-anz.trendmicro.com
            • Japan: tmems-jp.trendmicro.com
            • Singapore: tmes-sg.trendmicro.com

           

          

          ^{Click the image to enlarge.}

       3. Click Save.
       4. Select No, I'll test later when prompted to test the single sign-on with Trend Micro Email Security Administrator Console. It is recommended to perform a test after all SSO settings are complete.
    2. Configure the Attributes & Claims. If the email addresses in your organization are defined by another source attribute, do the following:
       1. Under Attributes & Claims, click Edit.
       2. Click Add new claim. This will open the Manage claim screen.
       3. Configure the following fields:
          • Claim Name: specify claim name
          • Namespace: leave empty
          • Source: Attribute
          • Source Attribute: select a value from drop-down list.
           

          • When configuring the identity claim type for an SSO profile on Trend Micro Email Security, make sure you use the claim name specified here.
          • User attributes and claims are used to get the email addresses of logon subaccounts to authenticate their identity. By default, the source attribute user.mail is preconfigured to get the email addresses.
       4. Click Save.
    3. Configure the SAML Signing Certificate, perform the following:
       1. Under SAML Signing Certificate, click Edit.
       2. Specify an email address for the Notification Email Addresses field.
       3. Click Save.
    4. Under SAML Signing Certificate, click the Download link for Certificate (Base64). This will download a certificate file which will be used for Azure AD signature validation on Trend Micro Email Security.
        

       The downloaded certificate will be used when setting up SSO from the Trend Micro Email Security web console.

        
    5. Under Set up Trend Micro Email Security Administrator Console, take note of the login and logout URLs.

       

       ^{Click the image to enlarge.}

        

       The URLs will be used when setting up SSO from the Trend Micro Email Security web console .