Azure AD Joined SSO Access to AD Joined Resources

Florian Ried 0 Reputation points
2023-03-04T09:56:26.5866667+00:00

Hello everyone,

I am currently using the default Azure DNS as the DNS server within an Azure Virtual Network. The network is connected to AVD Multi-Session Hosts that are Azure AD Joined. The virtual network is peered with another network, in which a classic Active Directory Domain Services VM domain-demo.de is located. To authenticate against the Azure AD Joined AVD Session Hosts, a hybrid user is used, which is synchronized from the Active Directory domain domain-demo.de via Cloud Sync.

I am looking for guidance on how to properly configure DNS, so that Azure AD Joined VMs can resolve the domain-demo.de domain correctly, and obtain a correct Kerberos ticket via LSA to authenticate against classic file shares, etc.

I have attempted to create an Azure Private DNS Zone (domain-demo.de) and linked it to the virtual network of the session hosts. Within the DNS zone, I created the following SRV records (_kerberos._tcp, _ldap._tcp) and an A-record for the DC's name along with its IP address. Unfortunately, this configuration did not result in the desired outcome.

Could you please provide some advice or steps on how to achieve this DNS configuration? Thank you in advance for your help!

Azure DNS
Azure DNS
An Azure service that enables hosting Domain Name System (DNS) domains in Azure.
592 questions
Azure Virtual Desktop
Azure Virtual Desktop
A Microsoft desktop and app virtualization service that runs on Azure. Previously known as Windows Virtual Desktop.
1,361 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Silvia Wibowo 2,851 Reputation points Microsoft Employee
    2023-03-05T22:49:54.2733333+00:00

    Hi @Florian Ried , your use case is Hybrid DNS resolution. You need a DNS forwarder from Azure towards on-prem domain. You can use Azure DNS Private Resolver and set the DNS Forwarding Ruleset to use Domain Controller of domain-demo.de

    Please do some due diligence on Azure DNS Private Resolver pricing to avoid an unexpected bill.

    1 person found this answer helpful.
    0 comments
  2. Florian Ried 0 Reputation points
    2023-03-06T07:29:43.5766667+00:00

    Hi @Silvia Wibowo

    Thanks for your awesome tip! I've successfully set up an Azure Private DNS Resolver with an Outbound Connection and a Rule Set for domain-demo. The clients are now able to resolve the domain-demo domain name without any issues.

    So, I've connected to a network drive and now I'm getting a login window where I have to enter my user information. After retyping my username and password, I land on the CIFS share. However, SSO isn't working yet. The file share that I've created is located directly on the DC for testing purposes. I've enabled Kerberos logging on the client and I'm seeing some warnings and errors after attempting to access it.

    User's image

    User's image

    I'm not sure what other configurations I need to make in order for SSO to work, but according to a Microsoft DOC article, no further configurations are required: https://learn.microsoft.com/en-us/azure/active-directory/devices/azuread-join-sso

    I should also mention that on the DC side, I haven't been able to detect any Kerberos requests with IDs 4768, 4769, or 4770 yet.

    I'd really appreciate any help or advice on this.

    Thanks so much!