SSO from Azure AD to Azure Active Directory Domain Services (AADDS)

Question

Dear All,

I have the following scenario:

• On-premises domain with ADConnect syncing users to Azure AD (SSO, Password Writeback and Password Hash Sync enabled)
• Azure Active Directory Domain Services enabled in Azure, using a complete different domain name as the On-Premises domain (hereby following the best practices)
• A Server 2022 VM in Azure that is joined to the AADDS domain serving several resources, for example file shares.
• Some Cloud only users (created in Azure AD, non existing in the On-Premises Domain).
• Some Hybrid users (created in On-Premises Domain and synced to Azure AD).
• Resetted the Password of both user types to make sure that the password hash is correctly synced to AADDS.

Now my goal is that when users log on to an Azure AD joined device (Win10 based, Intune Managed) are able the access resources on the Server 2022 machine without an extra credential prompt.
The thing is that my tests on this part show different results when it comes to the different user types.
For users that originate from the On-Premises AD SSO seems to work just fine and users are able to access shares on the Server 2022 server without extra prompts.
For users that are created in Azure AD (cloud only) this does not work, they are prompted for credentials when trying to access shares on the Server 2022 server.

When searching the internet I found several articles that SSO from AADDS joined devices to Azure AD based resources (like O365) is currently not supported and/or working.
I understand why this is the case, but my scenario is the other way around. I want Users on Modern, Intune Managed, Azure AD Joined endpoints to be able to SSO into some legacy resources that are still needed within the organization for the time being.
I cannot seem to find any Documentation on this matter and if this should or shouldn't work.
One would think that this is one of the main focus scenarios where AADDS show's its value.

Can someone shine some light on this one?

• Should SSO work in this scenario?
• If so what can I do to make it work or find more info regarding this?
• If not, why is it working for Users that originate from the On-Premises AD?

I do have contact with MS support regarding this but at the moment they state that SSO in my scenario is not working because it is also not working the other way around not being able to support this with references to Docs, witch feels that the matter is a bit oversimplified on their part.

thanks in advance for thinking with me on this one,

kind regards,

Martijn
The Netherlands.

Answer 1

Hi Martin,

in Azure AD DS there is feature known as Kerberos Constrained Delegation and it is resource-based, however for the On-premise DS the KCD is Resource-based & account-based. I suspect this is causing the issue with your scenario and would suggest you review this technical article and steps mentioned in this to carry out the checks for the KCD.

Other articles and support links are already provided by Sashi for SSO so that should help.

deploy-kcd

Detailed information on the way KCD functions. jj553400(v=ws.11)

Answer 2

Were you be able to solve it yet?