Azure AD Seamless SSO and Teams error

Question

Azure AD Seamless SSO and Teams error

DavidM 0

We have successfully enabled seamless SSO in our Active Directory - Microsoft Entra ID environment by following Microsoft's quickstart guide (https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-quick-start) and tested it by browsing to https://myapps.microsoft.com/ourdomain.onmicrosoft.com. Test was successful and we are automatically logged in.

The problem we actually have is that we can't auto sign on Microsoft Teams or any other office desktop apps (Word, Excel...).

Speaking about Teams, we've installed it by downloading teamsbootstrapper.exe (https://go.microsoft.com/fwlink/?linkid=2243204&clcid=0x409) and running .\teamsbootstrapper.exe -p. Teams successfully opens but it always prompts for user and password.

When it comes to Word or any other office desktop app, we actually see user's information in the top right corner of Word's starting page, and when we browse into Open from OneDrive, we can click the "Sign on" button. Once we've clicked it, we get prompted to select an account to log into OneDrive and we select current logged in user's account, but the prompt just closes and nothing happens.

Things that we already did/check:

Configure GPO to set up intranet sites, setting up "https://autologon.microsoftazuread-sso.com" and "https://teams.microsoft.com" to be part of it.
Configure all other GPO values mentioned in quickstart guide.
Reinstall Teams.
Clear teams temporal files
Ensure that the GPO is correctly applied
Navigate to https://myapps.microsoft.com/ourdomain.onmicrosoft.com to check that the user doesn't have to enter nor username or password.
Navigate to https://portal.office.com to check that user only has to write down the username.

Our machines are running:

Windows 10 22H2
Latest Teams version (recently downloaded it)
Word is part of the Microsoft Office Professional Plus 2019 suite.

Thanks beforehand!

Anonymous

2024-11-12T02:03:26.4366667+00:00
Hi @DavidM

According to our official documentation, please check if these are the issues you are encountering:

In a few cases, enabling Seamless SSO can take up to 30 minutes.

If you disable and re-enable Seamless SSO on your tenant, users won't get the single sign-on experience till their cached Kerberos tickets, typically valid for 10 hours, have expired.

If Seamless SSO succeeds, the user doesn't have the opportunity to select Keep me signed in.

Microsoft 365 Win32 clients (Outlook, Word, Excel, and others) with versions 16.0.8730.xxxx and above are supported using a non-interactive flow. Other versions aren't supported; on those versions, users will enter their usernames, but not passwords, to sign-in. For OneDrive, you have to activate the OneDrive silent config feature for a silent sign-on experience.

Seamless SSO doesn't work in private browsing mode on Firefox.

Seamless SSO doesn't work in Internet Explorer when Enhanced Protected mode is turned on.

Microsoft Edge (legacy) is no longer supported

Seamless SSO doesn't work on mobile browsers on iOS and Android.

If a user is part of too many groups in Active Directory, the user's Kerberos ticket will likely be too large to process, and this will cause Seamless SSO to fail. Microsoft Entra HTTPS requests can have headers with a maximum size of 50 KB; Kerberos tickets need to be smaller than that limit to accommodate other Microsoft Entra artifacts (typically, 2 - 5 KB) such as cookies. Our recommendation is to reduce user's group memberships and try again.

If you're synchronizing 30 or more Active Directory forests, you can't enable Seamless SSO through Microsoft Entra Connect. As a workaround, you can manually enable the feature on your tenant.

Adding the Microsoft Entra service URL (https://autologon.microsoftazuread-sso.com) to the Trusted sites zone instead of the Local intranet zone blocks users from signing in.

Your issue is likely related to enabling Seamless SSO. In order to better help you, I will add Azure-related tags to your post. Thanks for your understanding and patience!
DavidM 0 Reputation points

2024-11-12T08:19:05.4466667+00:00
Hey @Anonymous !

I'll answer step by step so I don't miss out any of the issues you relate:

In a few cases, enabling Seamless SSO can take up to 30 minutes.

Feature was enabled for a long period of time but noe we are testing issues due to our users reporting us that they are not auto-signed in

If you disable and re-enable Seamless SSO on your tenant, users won't get the single sign-on experience till their cached Kerberos tickets, typically valid for 10 hours, have expired.

Didnt disable/re-enable

If Seamless SSO succeeds, the user doesn't have the opportunity to select Keep me signed in.

Ok.

Microsoft 365 Win32 clients (Outlook, Word, Excel, and others) with versions 16.0.8730.xxxx and above are supported using a non-interactive flow. Other versions aren't supported; on those versions, users will enter their usernames, but not passwords, to sign-in. For OneDrive, you have to activate the OneDrive silent config feature for a silent sign-on experience.

We do not use OneDrive client in out environment. Anyway, we enabled that regkey mentioned "SilentAccountConfig" but still doesn't work.

Seamless SSO doesn't work in private browsing mode on Firefox.

Not the problem

Seamless SSO doesn't work in Internet Explorer when Enhanced Protected mode is turned on.

Not the problem

Microsoft Edge (legacy) is no longer supported

Not the problem

Seamless SSO doesn't work on mobile browsers on iOS and Android.

Not the problem

If a user is part of too many groups in Active Directory, the user's Kerberos ticket will likely be too large to process, and this will cause Seamless SSO to fail. Microsoft Entra HTTPS requests can have headers with a maximum size of 50 KB; Kerberos tickets need to be smaller than that limit to accommodate other Microsoft Entra artifacts (typically, 2 - 5 KB) such as cookies. Our recommendation is to reduce user's group memberships and try again.

Test users currently have arrount 10-15 groups. Do not consider that to be "too many groups".

If you're synchronizing 30 or more Active Directory forests, you can't enable Seamless SSO through Microsoft Entra Connect. As a workaround, you can manually enable the feature on your tenant.

Not our case, only 2 forests.

Adding the Microsoft Entra service URL (https://autologon.microsoftazuread-sso.com) to the Trusted sites zone instead of the Local intranet zone blocks users from signing in.

Done.

As you can see, any of these issues are our current problem. Our issue persists, we can't auto signin Teams or Word's OneDrive storage.
André Pflaum 0 Reputation points

2024-12-12T14:30:26.42+00:00

Hi David,

I have the absolute same behavior currently too. Did you find anything out in the meantime? Please let me know. If not, I will investigate further too and would let you know, if I come to a solution.

André

1 answer

Your answer

André Pflaum 0 Reputation points

2024-12-12T14:30:26.42+00:00

Hi David,

I have the absolute same behavior currently too. Did you find anything out in the meantime? Please let me know. If not, I will investigate further too and would let you know, if I come to a solution.

André

Answer 1

Andy David - MVP 157.8K MVP Volunteer Moderator

I personally recommend you do not enable Seamless SSO:

https://trustedsec.com/blog/azure-ad-kerberos-tickets-pivoting-to-the-cloud

Share via

Azure AD Seamless SSO and Teams error

1 answer

Your answer