Microsoft SSO Not Working After Re-Image

[speakercon]

I enabled MS SSO by ticking it in AD connect and syncing the computer OU's and it worked brilliantly, all windows devices showed as hybrid domain joined in Azure.

 

However my happiness was short lived as I've found after re-imaging a machine it doesn't seem to update in Azure, the 'old' machine just shows as no activity since it was re-imaged.

 

If I delete the 'old' machine and then reboot it, it then re-appears in Azure but SSO doesn't work - Cloud Drive Mapper does authenticate on its own but Teams and Edge still prompt for email/password whereas before the re-image all 3 apps signed in automictically.

 

Is it normal to have to delete hybrid domain joined devices from Azure before re-imaging? Even if I do this Edge and Teams no longer work with SSO.

 

What am I doing wrong!?

[DavR]

IIRC, when you rebuild a workstation, the workstation will need to redo the hybrid domain join. It may not do this immediately, it might take a short while. Although I must admit in my experience, it's always been ready in time for first login.

 

If you run the PC for a few hours, do you see an update on the machine account in Azure?

 

You can force the hybrid domain join by running a task from Task Scheduler - Go to Task Scheduler Library > Microsoft > Windows > Workplace Join and manually start the task “Automatic-Device-Join“. If you still can't get SSO to work after running that task, it would suggest to me that hybrid join is failing for some reason.

[Squelch]

https://learn.microsoft.com/en-us/azure/active-directory/devices/faq

 

Have a look here, it explains why there are old records in azure. I check the status of the computer with dsregcmd /status and then use the /leave switch to remove it from azure.

[speakercon]

Okay after further investigate it looks like it is only machines running LTSB 2016 that are having the SSO issue even before re-imaging, CDM authenticates okay but Teams & Edge do not. I'm not very bothered by this as these machines need updating anyway.

 

Machines running newer OS's always seem to join azure instantly if they have never joined before but there does seem to be a delay if the machine has been re-imaged and is already in Azure. I've tested this and it seems to vary from hours to minutes.

 

If I check the device-join task after the task sequence has run it shows as 0x1 - privilege issue. I've tried to run this after varying amounts of time and at some point the task runs (or letting it run by logging out and in). I guess it is what it is you just have to wait.