OneDrive Mapping - Azure AD Connect - SSO

[The_W]

Hi All,

 

Installed the Preview of the new Azure AD connect to allow us to implement SSO with Azure AD Password Hash Sync - https://blogs.technet.microsoft.com/enterprisemobility/2016/12/07/introducing-azuread-pass-through-authentication-and-seamless-single-sign-on/

 

Working Really well for signing in Office 2016 apps and removing the user to type a password (when on a domain joined PC) to access portal.office.com.

 

However!!

 

I have found that mapping a network drive to OneDrive now fails due to the users not setting a cookie when logging into the portal. This I believe is due to the user not being able to tick the 'keep me signed in' box as the browser intercepts the sign-in and quickly signs the user in via SSO.

 

Question - Does anyone have a similar setup or have found a way of keeping the cookie persistent?

 

I was intending on using the OneDriveMapper tool - OneDriveMapper | Liebensraum but this yields the same results. The user is given a 'access denied' message when attempting to map the drive.

 

I've added the relevant sites to the trusted sites etc....before moving to SSO this worked fine!

 

Thanks

W

[Homer]

That looks quite exciting, so Outlook doesn't prompt for credentials? Or am I missing the point (coffee depraved, Friday morning brain)

[The_W]

Not with the new client, they get 1 prompt initially but that also SSO signs in once you click in the password prompt.

 

I think Microsoft still have some work to do to streamline everything but it's a step forward.

[pjefferson]

I am having the exact same problem and have been working with Jos. What we have found so far is that if we remove the two entries from the GPO that enable the SSO (there by breaking SSO) the OneDriveMapper script prompts for a password and maps the drives successfully. If we put the keys back in SSO now works but the OneDriveMapper script no longer maps the drives and complains about the required sharepoint entries being in the Trusted Zones files (which they are).

 

Let me know if you have any luck with it.

[The_W]

I too had contacted Jos about this but we had no joy (although I was unable to provide him access to my environment for further debugging)

 

One thing I am working on, is having the OneDrive Powershell add the SSO urls to the registry post mapping of the drive, this way I get the best of both worlds, (it just feels a little messy!!)

 

The only problem I have at the minute is getting Powershell to add the URLs when Intranet Zones are configured via GPO! It seems to block any additional sites from adding via Powershell.

[DavidYoung]

Hi,

 

Has anyone seen or tried the powershell command set-spotenant -UsePersistentCookiesForExplorerView as mentioned in this technet article (second parameter from the bottom): https://technet.microsoft.com/en-us/library/fp161390.aspx#Anchor_3 ?

[wickit]

I too had contacted Jos about this but we had no joy (although I was unable to provide him access to my environment for further debugging)

 

One thing I am working on, is having the OneDrive Powershell add the SSO urls to the registry post mapping of the drive, this way I get the best of both worlds, (it just feels a little messy!!)

 

The only problem I have at the minute is getting Powershell to add the URLs when Intranet Zones are configured via GPO! It seems to block any additional sites from adding via Powershell.

 

I am having the same issues as the rest of you...

Whats odd I did get it working fine on one PC Client, but for the life of me work out what i had done

 

 

As for adding zones without using GPO, just do the zones via a registry gpo, instead that way you can still add more manually.

[IAMCloud_Leon]

Hey - I work for the company I'm about to recommend, so feel free to take my advice with a pinch of salt - but you might want to try this https://www.iamcloud.com/cloud-drive-mapper It does what you're looking for, and it's inexpensive, and fully supported by technical support and development teams who are on point whenever Microsoft likes to make random changes to its service that would otherwise break your file storage access Our customers have found it's much more stable than the PowerShell script alternative as well. We won Microsoft's Worldwide Education partner of the year award in 2015/16 because of it, and so far it has about 1.1 million users. But that's all hype, best to just try it out and see it working for yourself. Here's a free trial link: https://www.iamcloud.com/cloud-drive-mapper-trial-signup Cheers, and sorry for the (hopefully not unwarranted) promo.