O365 and ADFS

[NewBoy]

We have recently had ADFS setup for us so that we no longer have to use a syncing tool when changing passwords within AD and o365, it works seamlessly with MS Outlook but not with web browsers i.e. trying to log into o365 portal it still prompts for email address and password.

 

Should ADFS do this for me or am I expecting to much ??

 

I have tried adding trusted site within IE settings and also telling it to use the current logon credentials but to no avail, we have to sign off on this project at the end of the week and I would really love to know if ADFS should SSO me into an o365 browser or not.

[FN-GM]

I don't think the admin portal works with SSO. But with other apps you can use these "magic links"

 

For example Outlook Web App would be:

 

https://outlook.com/schooldomain.com

[Roberto]

You've got things slightly backwards: ADFS doesn't sign you into office 365, rather office 365 should forward authentication requests to your ADFS server. I'm not merely being pedantic, with that statement but rather trying to say that what you're describing isn't entirely clear; what actually happens when your users log in? Office 365 needs to be configured to authenticate users against ADFS instead of its own Azure AD objects, for example.

 

It works here and users on-site connect to Office 365 and everything else we've federated via ADFS. We'd regard any user being asked to log in (not simply being confronted with a login screen if they browse to https://portal.office.com, but actually then having to type in their password) as a fault in our systems that should be fixed, provided they're using a supported browser.

 

Have you read https://gallery.technet.microsoft.com/Setup-Office-365-Single-1016583a

Edited October 24, 2017 by Roberto

[lmgtfy]

I don't think the admin portal works with SSO. But with other apps you can use these "magic links"

 

For example Outlook Web App would be:

 

https://outlook.com/schooldomain.com

 

Thanks @FN-GM I never knew about https://outlook.com/schooldomain.com are there any other ones that just get you the portal for users that don't have a mailbox do you know?

 

Cheers

[Steve21]

Any of the standard smartlinks should work if it's setup:

 

CRM/Dynamics Online:

Please verify your domain is correct, assumptions were made for your tenant name.

https://myschool.crm.dynamics.com/?whr=myschool.co.uk

 

Excel Online:

https://login.microsoftonline.com/login.srf?wa=wsignin1%2E0&rver=6%2E1%2E6206%2E0&wreply=https%3A%2F%2Foffice.live.com%2Fstart%2FExcel.aspx%3Fauth%3D2&whr=myschool.co.uk

 

My Apps Portal:

https://myapps.microsoft.com/?whr=myschool.co.uk

 

OneDrive for Business:

Please verify your domain is correct, assumptions were made for your tenant name.

https://login.microsoftonline.com/login.srf?wa=wsignin1%2E0&rver=6%2E1%2E6206%2E0&wreply=https%3A%2F%2Fmyschool-my.sharepoint.com%2F&whr=myschool.co.uk

 

Outlook Calendar:

https://outlook.office.com/owa/?realm=myschool.co.uk&path=/calendar/view/Month

 

Outlook Web Access to Exchange Online:

https://outlook.com/owa/myschool.co.uk

 

Self Service Password Reset (SSPR):

https://passwordreset.microsoftonline.com/?whr=myschool.co.uk

 

SharePoint Online:

Please verify your domain is correct, assumptions were made for your tenant name.

https://login.microsoftonline.com/login.srf?wa=wsignin1%2E0&rver=6%2E1%2E6206%2E0&wreply=https%3A%2F%2Fmyschool.sharepoint.com%2F&whr=myschool.co.uk

Note: SharePoint Online has released a feature called Auto-Acceleration which will fix the issue of sending someone a link internally and them being prompted to login. I'd recommend enabling this functionality via PowerShell for interal users. There is an option to enable this for external users as well, however this can cause home-realm discovery issues with Azure B2B. More details on this feature are found here:

https://support.office.com/en-us/article/Enable-auto-acceleration-for-your-SharePoint-Online-tenancy-74985ebf-39e1-4c59-a74a-dcdfd678ef83?ui=en-US&rs=en-US&ad=US

 

Word Online:

https://login.microsoftonline.com/login.srf?wa=wsignin1%2E0&rver=6%2E1%2E6206%2E0&wreply=https%3A%2F%2Foffice.live.com%2Fstart%2FWord.aspx%3Fauth%3D2&whr=myschool.co.uk

 

Guessing you mean the myapps one? Or did you mean the old style portal with the software install etc for 365?

 

Steve

[Katy]

I recently set up ADFS to stop people having to enter their credentials all the time whilst on site. While it worked fine for IE it didn't work in Chrome - turns out that ADFS won't allow that from Chrome/Edge user agents by default, you need to run this:

 

[color=#000000][font=tahoma]Set-AdfsProperties –WIASupportedUserAgents @(“MSAuthHost/1.0/In-Domain”,”MSIE 6.0″,”MSIE 7.0″,”MSIE 8.0″,”MSIE 9.0″,”MSIE 10.0″,”Trident/7.0″, “MSIPC”,”Windows Rights Management Client”[/font][/color][color=red][font=tahoma],”Mozilla/5.0″,”Edge/12″[/font][/color][color=#000000][font=tahoma])

 

(You need to fix the quotes first when copy/pasting into powershell)

 

[/font][/color]http://www.vspbreda.nl/nl/ms-office/office-365/solved-adfs-enable-single-sign-on-sso-for-edge-and-chrome-browser/

 

Then by visiting the "standard" links (outlook.office.com) you'd only need to enter the username, at which point it would redirect to ADFS and log you in automatically, or if using the "magic links" it'd not ask for anything.

 

[lmgtfy]

 

Guessing you mean the myapps one? Or did you mean the old style portal with the software install etc for 365?

 

Steve

 

Thats amazing the myapps bit was what I was after I will have to look into customising this now.

 

Cheers

[lmgtfy]

All I can find is this page https://docs.microsoft.com/en-us/azure/active-directory/active-directory-saas-access-panel-introduction but no help on how to add or remove applications. O how I love Microsoft's web of confusion. Anyone customised this at all?