ad office 365 sso

[sted]

so as you can see from previous posts ive been playing round with sso /azure ad

i think i have that part down to teh point i understand what im doing

 

what im trying to do now is get it so people signing in on a domained pc can get automatically signed in to office 365 (via browser) onedrive, word, outlook.

 

so far it looks like ive set it up correclt got it set to pass-through auth in azure (though it did throw up a message about port 443 but it shows in the console as working (though i do have a yellow ! asking me to install an agent on 1 or more servers

when i sign in to a windows 10 vm its as if sso wasnt turned on. ive got a gpo adding the required site to the intranetzone and ive allowed status bar updates via scripts as documentation said.

 

looking at troubleshooting guides they seem to suggest if i run klist i should see 1 or more kerberos tickets marked with AZUREADSSOACCT but i dont seem to have any

 

any ideas? my best guess is its the port 443 issue but im not sure theres a lot i can do about that at last not quickly as i dont think its specificly blocked anywhere and ive not seen anything suggesting i need port forwarding to a real world ip

[Steve21]

We don't use passthru but the tokeny one, but should be same process I guess.

 

You say "the site" to intranet zone but there should be multiple as it's special microsofty login ones, not the site for email etc. Or was that just phrasing?

 

Also did you run the powershell to enable modern auth on your tenant?

 

Also lastly take it you're not using Edge as it doesn't like it

 

Steve

[sted]

We don't use passthru but the tokeny one, but should be same process I guess.

You say "the site" to intranet zone but there should be multiple as it's special microsofty login ones, not the site for email etc. Or was that just phrasing?

Also did you run the powershell to enable modern auth on your tenant?

Also lastly take it you're not using Edge as it doesn't like it

Steve

it was a specific site i think (sorry ive logged off the remote server and as it requires 2fa im horlixed ive got no phone signal) it was https://autologon.microsoftazuread-sso.com or something similar

dont remember seeing that anywhere in teh guides i was using so no

i was mainly trying edge but i did try ie as well with the same result

[Steve21]

There's https://autologon.microsoftazuread-sso.com and https://aadg.windows.net.nsatc.net unless they changed it recently.

 

Also for the modern auth side, if you run (online powershell wise)

Get-OrganizationConfig | Format-Table -Auto Name,OAuth*

if it's not enabled you'll need to do

Set-OrganizationConfig -OAuth2ClientProfileEnabled $true

 

Once that's done are you using the outlook smart link to try to browse to it? Else it won't work either if you just try to open outlook etc, you need to use one that's like:

https://outlook.com/owa/my.school.co.uk etc

 

 

 

You'll find Edge isnt' supported at all, IE should be fine and Chrome:

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-sso

 

Steve

[sted]

ok back looking at it again as im not busy

put auth method back to password hash (that was the default but some of the guides id been looking a said set to passthrough

guide im following is https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-sso-quick-start

 

so ive added https://autologon.microsoftazuread-sso.com to the local intranet zone (though clicking it i just get a 404 page where i am and where the remote server im on is both on completely different internet connections)

 

made sure im using ie e=rather than edge

 

only thing i can see that looks like it might be an issue is under singled sign on in azure it shows ad.domain name rather than domain name (ad. is the active directory name but ive added the non ad version as a suffix and my test users all have that assigned to them)

 

im just going to mail.office365.com to test as that worked on my azure ad connected pc

 

just tried https://outlook.com/owa/school and that signs in hmm ok to more fiddling its mainly one drive i want to auto signin

[sted]

and onedrive worked after using the later outlook link as well just seeing if i can replicate on a 2nd pc

[Steve21]

and onedrive worked after using the later outlook link as well just seeing if i can replicate on a 2nd pc

 

Not sure if you mean OneDrive web-based or not but if you want the other smart links:

 

http://www.edugeek.net/forums/cloud-services/189649-o365-adfs.html#post1622525

 

(Once you've got one open it should detect you in all programs, but might be easier to use a different one if you only wanted one bit)

 

Steve

[sted]

Not sure if you mean OneDrive web-based or not but if you want the other smart links:

 

http://www.edugeek.net/forums/cloud-services/189649-o365-adfs.html#post1622525

 

(Once you've got one open it should detect you in all programs, but might be easier to use a different one if you only wanted one bit)

 

Steve

onedrive sync client (web version isnt going to help me if i can get sso working it means one less reason for anyone to use a pen drive ever as if its auto setup they dont even have to plug in a pen drive to use it

only caveat ive found is you have to have used onedrive at least once for it to work or it just prompts for credentials.

 

ive manged to replicate my results on a 2nd vm so im happy it works at least in a test setting so thanks