This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(262.40000000000003, 41%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAA%3C/text%3E%3C/svg%3E)
Hello.
Scenario: Subdomain is already federated. Lets call this corp.contoso.com. Its issuerURI is http://corp.contoso.com/adfs/services/trust/. Users in subdomain use exchange online.
The top level domain, contoso.com, has been verified in Azure AD but not yet federated. Looking to federate it. Users in this domain have hybrid exchange with most on premise. There is password hash sync in place.
Using the below article for reference.
Question:
Since the subdomain is federated, Is convert-msolDomainIntoFederated -domainname consoto.com -SupportMultipleDomain the right way to proceed? I will be changing the UPN claims to the format specified in the article.
Thanks!
Most organizations are going the opposite direction. They are moving away from federation. Do you mind elaborating on the reasons why you want to use more of it?
@Pierre Audonnet - MSFT
The management wants the other domain federated for SSO experience. Since the subdomain was federated years back (those users in exchange online), now the top domain users are being migrated to EO. So, the desire is to have the same experience for users in both domains. The decision was made and I cannot change it unfortunately. Therefore, wanted to know if it was the correct sequence of action. If not, then looking for insight/guidance/tips. Thank you.
You do not ADFS to achieve SSO. Windows 10 machines? You have SSO out of the box with Hybrid-Azure-AD-Joined machine or Azure-AD-Joined machine. Even if you pick the PHS authentication scheme.
Don't have Windows 10 yet? Or not yet Hybrid? You can achieve SSO with Azure AD Connect Seamless-Single-Sign-On.
The two solution above are much easier solutions to maintain that an ADFS farm.
That said, regarding the multi domain configuration, there are also specific ADFS claims rules to configure to fully support it. This online tool will help you figure out which modification you need:
@Pierre Audonnet - MSFT
Thank you.
Would azure ad connect seamless sign on work for remote users that aren’t connected to corporate network or not using corporate domain joined machines? Majority are remote workers that use a portal (which in turn uses adfs sso) to sign in. They then use the email link from within to seamlessly sign in to email (for the users in sub domain).
For now, my immediate goal is to have the other domain federated. Then explore on moving sso to azure ad and also explore seamless sign on.
I think there is a confusion of terms here.
SSO refers to Single Sign On. It means that the user is never prompted for its password within its Windows session.
When ADFS is used externally (through a WAP) the user WILL be prompted to authenticate using Form Based Authentication. So there is no SSO.
So using Azure AD Connect Seamless SSO or ADFS in that case doesn't change a thing, the user will be prompted.
BUT, if you are telling me the user is currently NOT prompted when connected outside of the organization, it means that the machine is either Azure AD Joined or Hybrid Azure AD Joined and in that case, ADFS or Azure AD Connect Seamless SSO would not matter because the user would have a PRT.
>BUT, if you are telling me the user is currently NOT prompted when connected outside
The users get prompted once when connecting to the main portal. After that the cookies lets them single sign-on to all the other third party apps.
So for Azure AD connect seamless signOn I am understanding that out of corporate network or non domain joined computers will be prompted once and its seamless thererafter?
Much appreciated piaudonn. I will look into this moving forward. There's MFA to implement after federation. Might be a good time to revisit the whole thing. Thanks much
Yes. If the machine doesn't have a line of sight with the domain controller it will fall back to a Username and Password prompt.
That said, if your machines are Hybrid Azure AD Joined you'll get a PRT when the user open a session and you will not be prompted for password neither internally or externally.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 90%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAK%3C/text%3E%3C/svg%3E)
Hi, if the posted answer resolves your question, please mark it as the answer by clicking the check mark. Doing so helps others find answers to their questions.
The case was corp.contoso.com was federated but top level contoso.com wasn't.
Procedure followed was:
c:[Type == "http://schemas.xmlsoap.org/claims/UPN"] => issue(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", Value = regexreplace(c.Value, "^.@([^.]+.)?(?<domain>([^.]+.?){2})$", "http://${domain}/adfs/services/trust/"));
This worked.
Reference article:
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-multiple-domains