Enable Windows Seamless SSO on Windows Domain-Joined Workstations

Question

Enable Windows Seamless SSO on Windows Domain-Joined Workstations

Jeoffrey NGO 0

I am using Microsoft Entra ID Cloud Sync to synchronize user accounts from three organizational units with EntraID. The password and other parameters are correctly synced from on-premises to Entra ID. However, devices are not synchronized from on-premises to the cloud as I am using Microsoft Entra ID Cloud Sync and not Microsoft Entra Connect Sync. The Windows Servers are running on Windows Server 2016, and all users have Microsoft 365 Business Standard licenses, which prevents hybrid device enrollment.

I aim to enable seamless SSO for Windows users to access Microsoft Teams, Office 365, and other portals like portal.microsoft.com without needing to enter their usernames or passwords. I have enabled SSO on Entra Cloud Sync using the procedure from Microsoft's documentation and verified its status via PowerShell and the Azure portal. The computer account AZUREADSSOACC was created correctly, and I have also created the necessary GPO (https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-quick-start).

Despite these steps, seamless SSO is not working on my test workstation, which is domain-joined and running Windows 11. Users are still prompted for their usernames and passwords. The klist command does not list the AZUREADSSOACC server. The device has a direct connection to the domain controllers. The GPOS has been rolled out to the user. The device's time is synchronized with the time in both Active Directory and the domain controllers. The account AZUREADSSOACC is enabled and present in the Active Directory. The klist get AZUREADSSOACC works and add the AZUREADSSOACC in the klist command but SSO still doesn not work.

Did I do something wrong ? Does Microsoft Entra hybrid joined devices is required when using Microsoft Entra ID Cloud Sync ?

Jeoffrey NGO 0 Reputation points

2025-02-10T23:57:55.3966667+00:00
To achieve seamless Single Sign-On (SSO) without requiring manual intervention from end-users, I had to follow these steps:

Enable Entra ID Connect Sync for Devices: Ensure that Microsoft Entra Connect is configured to synchronize devices from the on-premises Active Directory to Entra ID.

Hybrid Join Devices: With Entra ID Connect Sync enabled, devices are detected as Microsoft Entra hybrid joined. This setup ensures that they are properly registered and managed in both environments.

Automatic SSO Configuration: With the devices hybrid joined, users benefit from seamless SSO without needing to manually add their Entra ID account in Windows Settings (Work or School account).

By implementing this approach, end-users will experience seamless access to organizational resources and services without any additional configuration steps on their part.
Xintao Qiao-MSFT 6,590 Reputation points Microsoft External Staff

2025-02-11T06:50:51.4866667+00:00

Hi, @Jeoffrey NGO

Looks like the issue is more related to Microsoft Entra ID. Please kindly understand that the Microsoft Exchange Hybrid Management tag here we mainly focus on general issues about Exchange. In order to better solve your problem, I will add “Microsoft Entra ID” for you. Thank you for your support and understanding!

1 answer

Your answer

Jeoffrey NGO 0 Reputation points

2025-02-10T23:57:55.3966667+00:00

To achieve seamless Single Sign-On (SSO) without requiring manual intervention from end-users, I had to follow these steps:

Enable Entra ID Connect Sync for Devices: Ensure that Microsoft Entra Connect is configured to synchronize devices from the on-premises Active Directory to Entra ID.

Hybrid Join Devices: With Entra ID Connect Sync enabled, devices are detected as Microsoft Entra hybrid joined. This setup ensures that they are properly registered and managed in both environments.

Automatic SSO Configuration: With the devices hybrid joined, users benefit from seamless SSO without needing to manually add their Entra ID account in Windows Settings (Work or School account).

By implementing this approach, end-users will experience seamless access to organizational resources and services without any additional configuration steps on their part.
Xintao Qiao-MSFT 6,590 Reputation points Microsoft External Staff

2025-02-11T06:50:51.4866667+00:00

Hi, @Jeoffrey NGO

Looks like the issue is more related to Microsoft Entra ID. Please kindly understand that the Microsoft Exchange Hybrid Management tag here we mainly focus on general issues about Exchange. In order to better solve your problem, I will add “Microsoft Entra ID” for you. Thank you for your support and understanding!

Answer 1

Andy David - MVP 153.8K MVP

That feature is not even needed for your version of Windows:

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso#sso-via-primary-refresh-token-vs-seamless-sso

User's image

I would recommend you disable the seamless SSO feature in Entra connect as its a security concern.

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-faq#how-can-i-disable-seamless-sso-

Kancharla Saiteja 1,980 Reputation points Microsoft External Staff

2025-02-13T07:59:22.3633333+00:00

Hi @Jeoffrey NGO ,

Thank you for posting your query on Microsoft Q&A. I am Saiteja from Q&A will be following you with your query.

I see @Andy David - MVP has already provided you the information on seamless SSO. Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Kancharla Saiteja 1,980 Reputation points Microsoft External Staff

2025-02-14T06:53:51.38+00:00

Hi @Jeoffrey NGO ,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Share via

Enable Windows Seamless SSO on Windows Domain-Joined Workstations

1 answer

Your answer