If you want more control over how users access %BRAND_OFFICE_365_SHORT%, you have the option to set up directory synchronization ...

If you want more control over how users access %BRAND_OFFICE_365_SHORT%, you have the option to set up directory synchronization with single sign-on (SSO) using Active Directory Federation Services (AD FS). Also called identity federation, this sign-in method ensures all user authentication is controlled on-premises and allows administrators to implement more rigorous levels of %BRAND_OFFICE_365_SHORT% access control. Identity federation with AD FS requires deploying additional servers in your environment. Identity federation also commits you to providing 24x7 support for your Active Directory and AD FS infrastructure. This high level of support is necessary because if your on-premises Internet access, domain controller, or AD FS servers are unavailable, your users will be unable to sign in to %BRAND_OFFICE_365_SHORT% services.