Azure SAML / SSO web app With external network

Question

I am looking at a way to implement a single sign of option on some of the web apps we have. To summarise this application is normally a web app on the internet. Essentially what I would like to do is for users to use their windows credentials to authenticate and access the website for clients. The Azure cluster is hosted separate to the network to the clients so this would need to be done on an individual basis (this would need to be setup for each application, on different networks) - what is the best way to tackle this, is it possible?

Answer 1

You can leverage Azure AD for implementing single sign-on for a web application. The broad steps using Azure AD are:

1. Create an Azure AD tenant and register your web app(s) with Azure AD.
2. Configure Azure AD to use Windows Integrated Authentication to authenticate the suers.
3. Configure your web app to use Azure AD for authentication.

In order to leverage Windows accounts for SSO, the account will need to be synced with Azure AD. The general steps are:

1. Install Azure AD Connect on a Windows Server machine. This machine should have access to your local Active Directory.
2. During the setup process, you'll be asked to provide credentials for your Azure AD (Office 365) tenant.
3. You'll also be asked to provide credentials for your local Active Directory.
4. You can then choose how you want your local Active Directory to sync with Azure AD. There are several options, including password hash synchronization, pass-through authentication, and federation.
5. Once you've made your selections, Azure AD Connect will begin syncing your local Active Directory with Azure AD.

Some good reference documentation to learn more are:

• Quickstart: Register an app in the Microsoft identity platform - Microsoft Entra | Microsoft Learn
• Enable single sign-on for an enterprise application - Microsoft Entra | Microsoft Learn
• Azure AD Connect: Seamless Single Sign-On - How it works - Microsoft Entra | Microsoft Learn
• Azure AD Connect: Get started by using express settings - Microsoft Entra | Microsoft Learn