Office 365

[clareq]

I have determined that my IE to Zone allocation GPO is preventing office add-ins from working. Do I still need to make sites "trusted" for SSO to 365 to work?

[3s-gtech]

Yes, 100%.

[clareq]

Strange - as a test I removed the policy, cleared my test user profile and logged in. SSO worked. The GPO I had used to set Trusted Sites had been in place for some years, but the add-ins only started failing recently. I wonder if something has been changed at microsoft's end. I can't find a definitive up to date list of URLs I need to trust.

[chaplic]

I remember back in the day a similar issue as Microsoft added a url microsoftonline-p.com to their URLs involved with login, the MS engineer I spoke to reckoned if you dont have ADFS then it doesnt matter what zone things are in as long as they are consistent.

 

So I'd try removing all zone entries and see how that behaves then you've removed a future headache.

[clareq]

I have done - I'll keep an eye on any log in issues, but my tests seem OK so far.

[KK20]

you need to make autologon.microsoftazuread-sso.com trusted so that you can pass the kerberos tickets to an internet/cloud site. Unless you have your security set so low that any internet site can request (!!). Im not sure if you actually need any other sites setting to trusted for SSO to work, we certainly dont have many in our zone allocation. Ive seen people putting *.office.com and *.sharepoint.com in there, we certainly havent.