Microsoft Releases Azure AD Pass through SSO

[jslate1980]

http://blog.enowsoftware.com/solutions-engine/microsoft-releases-azure-ad-pass-through-authentication-single-sign-on

[Blue_Cookeh]

I don't know what I'm doing wrong but I tried setting this up about 2 weeks ago and couldn't get any single sign on working at all

[timbo343]

Microsoft Releases Azure AD Pass-Through Authentication and Seamless Single Sign-on

 

Have you got this working? Ive read the notes but daren't switch over just yet.

[jslate1980]

Would be nice to cut down on some of our vm's that are needed for SSO. Currently have 2 federated servers and 2 waps but as we have exchange hybrid and the phone system is linked, there is no point with me changing at the moment.

[Blue_Cookeh]

I got it working last night. 1. make sure TCP9090 is allowed outbound from the machine you're running AAD Connect on, 2. make sure the two SSO URLs on the page OP linked are added to your Intranet Zone in IE. 3. I had to run the config two or three times for it to successfully update Office365 and our AD environment.

[timbo343]

I got it working last night. 1. make sure TCP9090 is allowed outbound from the machine you're running AAD Connect on, 2. make sure the two SSO URLs on the page OP linked are added to your Intranet Zone in IE. 3. I had to run the config two or three times for it to successfully update Office365 and our AD environment.

Can you set specific OUs to pass-through? It would be nice if student accounts could pass-through and staff accounts only password sync'd.

 

That way, theres no fear of staff who leave their machines unlocked, anyone could get to their emails without a password.

[Blue_Cookeh]

Can you set specific OUs to pass-through? It would be nice if student accounts could pass-through and staff accounts only password sync'd.

 

That way, theres no fear of staff who leave their machines unlocked, anyone could get to their emails without a password.

 

No, it's all or nothing on the AADConnect side. I suppose you could just not add the SSO URLs into the Intranet zone for staff users?

[timbo343]

Before i configure AAD PTA.. i've currently got Password Sync selected. If i choose Pass-Through Authenitication and select Enable Single sign on user's passwords will still be sync'd so if tey are at home or access their accounts via a mobile they will still use their AD password?

 

I've searched the documentation and cannot see the 2 URLs to put in the trusted zone - either i'm being blind and dumb.

 

 

 

EDIT: I think ive found them.. are they: portal.office.com & outlook.office365.com? I might add mail.office365.com too.

Edited January 18, 2017 by timbo343

[mikes]

This is just a simpler way to have SSO than the current AD FS / WAP that we are all using, correct ?

 

I currently have AD FS / WAP working for SSO, this seems a simpler way but not worth doing for me as I already have the AD FS / WAP working well?

[nicholab]

Why they had to make it 2012r2?

[Parm79]

https://www.google.co.uk/amp/s/marckean.com/2016/12/14/ad-connect-pass-through-authentication-sso/amp/

[Parm79]

Not my work but the url' s you need are in there

[nicholab]

Anyone got any ideas on why my password sync is not working on an ADFS domain? How do I get it to work?

[timbo343]

So ive done as the article (https://marckean.com/2016/12/14/ad-connect-pass-through-authentication-sso) says but it doesnt auto log us into Office 365.

 

EDIT: Apologies, it seems things are working here. I didn't realise users has to put in there email address only (see this video https://marckean.com/2016/12/16/azuread-pass-through-authentication-and-seamless-single-sign-on-ux/)

Edited August 14, 2017 by timbo343