Hybrid AD domain with O365 SSO, and then SSO to secondary GSuite domain

[highsky]

Hello all,

 

So after getting beaten by the lack of Azure AD Premium for password writeback on prem. And the ilogical behaviour of GSuite password reset, no option to prioritize the use of email as the first or only reset options for Edu environment i searched the current SSO options.

 

AD Connect supports with minimal configuration the SSO between the domain PCs and the online MS apps.

 

The GSuite connector from the Azure enterprise apps support the SSO even to a second trusted secondary domain with the use of email as the Name id and the joint function.

 

You can select to direct any GSuite password reset request, to the RDS password reset interface. As the initial login in GSuite with the temporary password is not needed.

 

To be tested, the login experience with Chromebooks. Everything else seems to be working.

 

Know bug, O365 users have the option to change their online account password despite no writeback feature in the non Premium Azure AD.

 

Is there anything that i should be aware of?

 

Credits to a K12 post for pointing to the joint function as the MS how to fails to cover this scenario and to Asitha De Silva for the AD Connect how to guide.