Office 365 AADConnect SSO / Options

[Maus]

Hi all,

 

We've been an Office 365 site since the summer, but up until now have not implemented SSO (though we have used DirSync and then AADConnect). I've now installed the new update to allow SSO, but it only seems to mean that the Windows domain users don't have to type the password in the Office 365 portal or Office 2016 (but still have to type their email address)...... Isn't the idea of SSO to not require entering credentials multiple times, even username, other than Windows Login? Obviously users with local or roaming profiles can store credentials, but our Mandatory profile users can't get anything remembered..

 

As a secondary query, does anyone have experience / recommendations of any of the other SSO option (ADFS, RM Unify etc) and do they prevent any additional data having to be entered at login?

 

Thank you in advance!

[TSEARS]

Not sure how the SSO works with ADConnect, although it would be nice to know how it works and how well it could work, as could be a potential replacement to ADFS.

We have an ADFS server which works brilliantly with SSO, it works on Chrome, Edge & IE so no complaints. We also use it when mapping OneDrive and Sharepoint as a network drive using a login script as it take the users domain credentials and authenticates against ADFS

[TSEARS]

And yes, using ADFS doesn't require any info to be entered, no email address or password

[psydii]

There is a new thing coming in the new year.

 

 

https://blogs.technet.microsoft.com/enterprisemobility/2016/12/07/introducing-azuread-pass-through-authentication-and-seamless-single-sign-on/

[TSEARS]

Cool, hopefully I'll be decommissioning ADFS at some point in the new year!

[Maus]

Hi Psydii, yes that's what I've configured, but for some reason the users have to put their email address in, then suddenly they get logged in by magic.. I'm having the hardest time figuring out if this is the intended behavior, or if there's something the configuration article doesn't say..

 

Interesting to know that ADFS is fully seamless at least, that is what I thought.

[lmgtfy]

Hi Psydii, yes that's what I've configured, but for some reason the users have to put their email address in, then suddenly they get logged in by magic.. I'm having the hardest time figuring out if this is the intended behavior, or if there's something the configuration article doesn't say..

 

Interesting to know that ADFS is fully seamless at least, that is what I thought.

 

I've installed the new version of Azure and can confirm it works the same for me in terms of users have to enter their email address and not the password. I have an autoit script that I run on login which automatically fills out the email address box which helps. If you interested let me know and I'll post it here.

 

Cheers

[Maus]

Hey Imgtfy that sounds great.. I was sure there must be some sneaky way to get a prompt auto-filled behind the scenes to skip them having to type it in. DM or reply in line would be awesome

[lmgtfy]

Hey Imgtfy that sounds great.. I was sure there must be some sneaky way to get a prompt auto-filled behind the scenes to skip them having to type it in. DM or reply in line would be awesome

 

Yes no problem. My code isn't great but it works 99% of the time. Feel free to change and re-write it and share it. Its written using AutoIt and then I compiled it to and EXE which then runs as a logon script for Students. I could share the EXE but don't want anyone thinking its dodgy so I'll just start with the code:

 

#comments-start

Program created to automatically enter email address into Office365 login page

#comments-end

 

 

; Start the main loop.

 

Opt("TrayIconHide", 1)

Do

 

; Wait until the logon window shows itself...

WinWaitActive("Sign in to your account - Internet Explorer")

 

 

; Add a little delay to avoid lag in accessing the website.

Sleep(1000)

 

; Send the current logged on username and email domain

Send(@UserName)

Send("@enter.yourdomainhere")

Send("{Tab}")

 

 

 

; Wait for the user to finish entering their password and then loop.

 

Sleep(5000)

WinWaitClose("Sign in to your account - Internet Explorer")

 

; Sleep again and then loop to beginning to avoid double pasting etc.

Sleep(10000)

 

; End of the main loop.

; Exit the loop using 'ExitLoop' command.

Until False

 

To be fair I might not even need the wait for password bit as thats automatic now but it seems to work just fine still.

 

Cheers

[GrahamRollerson]

hiya

 

no need for scripts. MS needs only your domain to know where to redirect to your ADFS/SAML service. all you need is a properly formatted URL

 

read this - https://chamonixvue.wordpress.com/2016/05/23/how-to-bypass-the-office-365-login-redirect-page-with-adfs/

[lmgtfy]

hiya

 

no need for scripts. MS needs only your domain to know where to redirect to your ADFS/SAML service. all you need is a properly formatted URL

 

read this - https://chamonixvue.wordpress.com/2016/05/23/how-to-bypass-the-office-365-login-redirect-page-with-adfs/

 

Thanks but we are not using ADFS/SAML we are using the new Azure AD which has built in single sign in without the need for ADFS/SAML.

[colacao82]

Thanks for the script Imgtfy! Does any one else know of another way of doing this please?

 

Thanks.

[wickit]

Sorry to hijack the post but im having some strange issues with SSO and ADDC.

I have enabled the sso and added the intranet zones as described here

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-sso

but for the life of me it does not seem to be working, I have checked our domain on AZURE and the domain info is as follows

TYPE Custom

STATUS Verified

FEDERATED No

 

Could any of these be the issue ?

Thanks in advance!

[wickit]

Further to this I have tried converting the domain to 'Federated' yet when I run the command

Convert-MsolDomainToFederated -DomainName

it errors

Please try running Set-MsolADFSContext before running this command again.

 

Odd seeing as the new AD connect says it does not require ADFS installed.... HELP!

[psydii]

Have you tried raising a support case via the Office365/Azure portal? I have found them to be very responsive and helpful when troubleshooting AzureAD Connect.

[wickit]

Contacted MS support and they managed to fix my issue