Azure AD Connect SSO Query

[Mr_Jiminy]

I'm struggling a little with the initial setup of PTA and SSO using the AD Connect tool.

 

After the point of selecting PTA and SSO, I receive the following promot, without any field to input local AD credentials.

 

[JOrdan01070]

I had this when i set up sso and i had to change the primary group of the user to domain admins i think to resolve it.

[Mr_Jiminy]

I don't follow

[synaesthesia]

I can't see how that would affect anything, primary groups in AD haven't done anything for years. They certainly won't have any effect on Azure AD.

[JOrdan01070]

I am not sure why I just changed from domain users to domain admins as the primary group and it worked, it took me a while to resolve as every thing I found pointed to firewall blocking access to *.msappproxy.net:9090

[synaesthesia]

There's quite a few addresses you need to make sure are clear:

 

mscrl.microsoft.com HTTP/80 Used to download CRL lists.

*.verisign.com HTTP/80 Used to download CRL lists.

*.entrust.com HTTP/80 Used to download CRL lists for MFA.

*.windows.net HTTPS/443 Used to sign in to Azure AD.

secure.aadcdn.microsoftonline-p.com HTTPS/443 Used for MFA.

*.microsoftonline.com HTTPS/443 Used to configure your Azure AD directory and import/export data.

 

*.blob.core.windows.net (port 443)

*.queue.core.windows.net (port 443)

*.table.core.windows.net(port 443)

*.servicebus.windows.net (port: 5671 recommended, if 5671 is blocked, the agent falls back to 443)

*.adhybridhealth.azure.com(port 443)

policykeyservice.dc.ad.msft.net (port 443)

login.windows.net (port 443)

login.microsoftonline.com (port 443)

secure.aadcdn.microsoftonline-p.com (port 443)

management.azure.com (port 443)

[Mr_Jiminy]

@synaesthesia thank you - you prompted me to go back back to look at filtering and transpires 'http://msappproxy.net' was being blocked.

[Mr_Jiminy]

Do I have to install the Microsoft Azure AD Connect Authentication Agent Package onto the AAD Connect server?