Currently we are doing Azure AD sync and we do not have Seamless Single Sign On check so it shows disabled. If I enable Seamless Sign On via the connect agent that is currently doing my AD to Azure AD sync what would be the impact to my users?

Hi @Winter2022 • Thank you for reaching out. The primary purpose of Seamless Single Sign-On is to automatically sign users into the Azure AD applications via their corporate devices without needing to re-enter the credentials. Same credentials can be used to access both on-prem as well as the cloud apps. With Seamless SSO, there won't be a negative impact on users. However, Microsoft recommends using Seamless SSO with Windows 7 and Windows 8.1. If you have Windows 10, Windows Server 2016, and later OS on your corporate devices, it’s recommended to perform Hybrid Azure AD Join and leverage primary refresh token (PRT) for the Seamless SSO experience. Read more: SSO via primary refresh token vs. Seamless SSO What is a Primary Refresh Token? Please " Accept the answer " if the information helped you. This will help us and others in the community as well.

New to Azure AD - Microsoft Q&A

Accepted answer

AmanpreetSingh-MSFT 56,641 Reputation points

2022-05-05T03:06:02.41+00:00
Hi @Winter2022 • Thank you for reaching out.

The primary purpose of Seamless Single Sign-On is to automatically sign users into the Azure AD applications via their corporate devices without needing to re-enter the credentials. Same credentials can be used to access both on-prem as well as the cloud apps.

With Seamless SSO, there won't be a negative impact on users. However, Microsoft recommends using Seamless SSO with Windows 7 and Windows 8.1. If you have Windows 10, Windows Server 2016, and later OS on your corporate devices, it’s recommended to perform Hybrid Azure AD Join and leverage primary refresh token (PRT) for the Seamless SSO experience.

Read more:

SSO via primary refresh token vs. Seamless SSO

What is a Primary Refresh Token?

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Winter2022 21 Reputation points

2022-05-05T16:32:16.46+00:00

Running dsregcmd /status says I am not in hybrid. Can I still use seamless sign on? In order to get my devices to hybrid join I need to run the connect tool again and select hybrid? I did not setup my current environment and this is first experience with Azure.

AzureAdJoined : NO
EnterpriseJoined : NO
DomainJoined : YES
DomainName : mydomain
Device Name : Device.mydomain.com

AmanpreetSingh-MSFT 56,641 Reputation points

2022-05-06T09:29:19.667+00:00

Hi @Winter2022 • There are 2 options that you have for Hybrid AAD Join, depending on your environment:

If you are using a federated domain and have ADFS or another Federation Server in your network, follow the below steps:

Federated Domain

If you are using a managed domain and don't have ADFS or any other Federation Server in your network, follow the below steps by running the AD connect tool again:

Managed Domain

Also, go through the prerequisites and Plan your hybrid Azure Active Directory join implementation to make sure you don't run into any issues during the setup.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

New to Azure AD

0 additional answers

Your answer