No sign on options for domain users synced with AD Connect after changing from federated to managed domain

Question

Hi:
I had the hybrid configuration working fine, with certain OUs syncing, and my users, computers, and groups all proper. Password hash sync was working and my domain users were syncing to azure ad without issue.

Then, I converted to federated domain with ADFS (I should not have) while testing in my lab. I switched back to managed but now my domain users, when attempting to access cloud resources, are given no sign options, only a logon screen after entering UPN that says "Choose a way to sign in" which is blank.

Sync is still working because I created a new user in the synced OU and ran the sync successfully, with the user account visible in Azure AD. However, attempts to use the account to auth to something like AVD, for example, result in the empty "Choose a way to sign in" screen.

What am I missing to get the password (and eventual MFA requirement) back for these user accounts? Accounts I created in the cloud only are fine.

Answer 1

Hi @Don Shappelle ,

Have you cheked that all requirement steps have been done?

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/migrate-from-federation-to-cloud-authentication

Answer 2

Hi @ DonShappelle-7845 , following up on your reply I wanted to post some more details here. After changing settings or syncing it usually takes up to an hour for everything to propagate. In the event that nothing updates within an hour usually means something is broken but yours isn't!

If this answer helped you please mark it as "Verified" so other users can reference it.

Thank you,
James