Windows Store apps \ (lack of) SSO

[gshaw]

I'm currently trying to deploy Microsoft Whiteboard across our Smartboard PCs (and then perhaps other devices) so we can trial the collaborative whiteboard feature. So far I've cracked these bits...

• sign up with Windows Store for Education
  
• enable Offline downloads
  
• obtain AppX package for Whiteboard
  
• deploy to all users on a machine using DISM
  

However when a user opens up the app it doesn't perform any SSO, contrary to everything else on Windows 10 \ Office 365 that federates via our Centrify (similar to ADFS) system. Users get asked for their account, which then signs in and prompts this rather strange message

 

Use this account everywhere on your device

 

Allow my organisation to manage my device (ticked by default)

 

 

As far as I can tell from running dsregcmd /status saying Yes here triggers a User Workplace Join, the benefits \ drawbacks of which I'm uncertain of on a domained PC.

 

We aren't yet using Hybrid Domain Join yet, which I believe may be the only way to get true SSO with the Store apps (well done MS ) but has anyone tried the above and got it to work smoothly?

[CHiLL]

Whilst not related to Microsoft Smartboard, I encountered that dialogue box a couple of weeks ago. I was testing the deployment of Office 365 to a test group, but configured the XML file incorrectly. I forgot to make the the product activation set as a shared PC, so when the user launched it, they were prompted to log into the Office application and that box came up, despite having AD FS set up. I found that actually pressing 'Yes' causing the box to crash/timeout and we had to press 'This app only' for the time being. After removing Office 365 and reinstalling it with the correct shared PC flag, the user it automatically logged in to the Office application.

 

I haven't had experience with Appx packages, but do they have any kind of XML configuration files, or something similar?

[abaxter2]

As you mention you have not tried Hybrid Domain Join yet - I have Azure Ad connect SSO + Hybrid Domain Join and can confirm that using the Hybrid Domain Join feature in Azure AD connect does sign the users in and does not give any warnings or messages about allowing my organisation to manage my device.

 

Also with the Hybrid Domain Join feature in Azure AD connect you can also set a GPO to only allow apps from Windows Store for Education.

[CHiLL]

As you mention you have not tried Hybrid Domain Join yet - I have Azure Ad connect SSO + Hybrid Domain Join and can confirm that using the Hybrid Domain Join feature in Azure AD connect does sign the users in and does not give any warnings or messages about allowing my organisation to manage my device.

 

Also with the Hybrid Domain Join feature in Azure AD connect you can also set a GPO to only allow apps from Windows Store for Education.

You need Azure AD Premium for Hybrid Domain Join don't you?

[abaxter2]

You need Azure AD Premium for Hybrid Domain Join don't you?

 

Nope - Azure AD connect is a free product, and I can confirm you do not need Azure AD premium to use this feature.

[gshaw]

As you mention you have not tried Hybrid Domain Join yet - I have Azure Ad connect SSO + Hybrid Domain Join and can confirm that using the Hybrid Domain Join feature in Azure AD connect does sign the users in and does not give any warnings or messages about allowing my organisation to manage my device.

 

Also with the Hybrid Domain Join feature in Azure AD connect you can also set a GPO to only allow apps from Windows Store for Education.

 

@abaxter thanks for the confirmation, that does seem the only way to achieve a seamless experience but we'd have to change our SSO provider from our existing Centrify SaaS IdP to Azure AD Connect to do it as Hybrid Join only seems to be supported when using Microsoft-only identity products.

 

I think that would mean losing ADFS Smart Links functionality, which we use to open up our SharePoint Intranet without username prompts so what I gain with one hand I lose with the other... unless I then go to Azure AD Connect + ADFS (which then means I need to put some of the ADFS in Azure for high availability)... arrgh!

 

We have the Education Store configured at present and restrict it to organisation-only apps, that element works well (apart from it sending emails when new apps are assigned which look remarkably like phishing emails!)

Edited November 5, 2018 by gshaw

[abaxter2]

@abaxter thanks for the confirmation, that does seem the only way to achieve a seamless experience but we'd have to change our SSO provider from our existing Centrify SaaS IdP to Azure AD Connect to do it as Hybrid Join only seems to be supported when using Microsoft-only identity products.

 

I think that would mean losing ADFS Smart Links functionality, which we use to open up our SharePoint Intranet without username prompts so what I gain with one hand I lose with the other... unless I then go to Azure AD Connect + ADFS (which then means I need to put some of the ADFS in Azure for high availability)... arrgh!

 

We have the Education Store configured at present and restrict it to organisation-only apps, that element works well (apart from it sending emails when new apps are assigned which look remarkably like phishing emails!)

 

Of course I do not know your setup and what services you use, but with mine I have no ADFS and use Azure AD connect for SSO + hybrid join - on my local lan no user is asked for a username or password when opening Office clients / accessing outlook on the web / Onedrive / Sharepoint / Windows store etc. You also have high availability by installing the Azure ad connect sync client on a second server: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-quick-start#step-4-ensure-high-availability

 

I do of course understand that you if are not currently using Azure AD connect then there is a lot to consider, and I am sorry that I cannot be more help with your current setup.

Edited November 5, 2018 by abaxter2

[gshaw]

Of course I do not know your setup and what services you use, but with mine I have no ADSF and use Azure AD connect for SSO + hybrid join - on my local lan no user is asked for a username or password when opening Office clients / accessing outlook on the web / Onedrive / Sharepoint / Windows store etc. You also have high availability by installing the Azure ad connect sync client on a second server: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-quick-start#step-4-ensure-high-availability

 

I do of course understand that you if are not currently using Azure AD connect then there is a lot to consider, and I am sorry that I cannot be more help with your current setup.

 

Interesting, so if you try the following does it work?

 

• find a SharePoint site on your Office 365
  
• copy link to a desktop shortcut
  
• open link into browser
  

Just to confirm you get no email address prompts at all and the first thing you see is the site?

 

In which case AAD Connect with the Hybrid Join must've improved and removed that additional step where it used to ask for your username, then signed in with SSO (i.e. no password required)

[abaxter2]

Interesting, so if you try the following does it work?

 

• find a SharePoint site on your Office 365
  
• copy link to a desktop shortcut
  
• open link into browser
  

Just to confirm you get no email address prompts at all and the first thing you see is the site?

 

In which case AAD Connect with the Hybrid Join must've improved and removed that additional step where it used to ask for your username, then signed in with SSO (i.e. no password required)

 

Yep - no email address or password prompts and the fist thing you see is the site - as long as you have permission to view that site ;-)

[gshaw]

Yep - no email address or password prompts and the fist thing you see is the site - as long as you have permission to view that site ;-)

 

Sounds like it's worth us migrating, especially now we have Azure AD Premium the password write-back sits nicely in with the AAD Connect side

 

Is your installation configured for "Seamless single sign-on" in Azure AD Connect?

[abaxter2]

Sounds like it's worth us migrating, especially now we have Azure AD Premium the password write-back sits nicely in with the AAD Connect side

 

Is your installation configured for "Seamless single sign-on" in Azure AD Connect?

 

Yep configured for "Seamless single sign-on" in Azure AD Connect, just not password write-back as at first we wanted users to only be able to set / change passwords on domain joined devices, also when we first started using AAD connect 2 years ago password write-back had a security issue (a year or so ago - that issue has been resolved in the latest versions tho) We use Pass-through Authentication: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta

Edited November 5, 2018 by abaxter2

[gshaw]

Sorry @abaxter2 one more question, does the Seamless SSO work OK in the latest version of Chrome? Just reading through the conversion documentation and found a few posts online about Chrome, just wanted to check if that's working OK now.

[abaxter2]

Sorry @abaxter2 one more question, does the Seamless SSO work OK in the latest version of Chrome? Just reading through the conversion documentation and found a few posts online about Chrome, just wanted to check if that's working OK now.

 

No probs @gshaw I can confirm that SSO does work in the latest version of Chrome - Chrome is still our default browser :-) Funny enough it was Edge that was having problems with AAD Connect + SSO, but so far in the windows 10 version 1803 SSO now also works with Edge.