{"id":62,"date":"2026-04-09T07:04:51","date_gmt":"2026-04-09T07:04:51","guid":{"rendered":"https:\/\/wordpress.sarservice.site\/?p=62"},"modified":"2026-04-09T07:09:40","modified_gmt":"2026-04-09T07:09:40","slug":"azure-ad-seamless-single-sign-on-setup-azure-ad-sso","status":"publish","type":"post","link":"https:\/\/wordpress.sarservice.site\/index.php\/2026\/04\/09\/azure-ad-seamless-single-sign-on-setup-azure-ad-sso\/","title":{"rendered":"Azure AD Seamless Single Sign-on – Setup Azure AD SSO"},"content":{"rendered":"\n

What is Single Sign-on<\/h4>\n\n\n\n

Azure AD Seamless Single Sign-on is a feature of Azure Active Directory that allows users to login to the applications without their usernames and passwords when they are using domain-joined machines. When this feature is enabled, users are automatically logged-in to the on-premises applications as well as the Cloud applications.<\/p>\n\n\n\n

Azure AD Seamless Single Sign-on benefits<\/h4>\n\n\n\n

Azure AD Seamless SSO is enabled using Azure AD Connect<\/a> (Microsoft Entra Connect). Below are few benefits provided by Azure AD Seamless SSO.<\/p>\n\n\n\n

    \n
  1. This feature is very easy to deploy. If you want to enable Azure AD SSO, you do not need any additional components in on-premises.<\/li>\n\n\n\n
  2. You can configure Azure AD Seamless Single Sign-on with Password Hash Synchronization or Pass-through Authentication. Both cloud-authentication methods are supported.<\/li>\n\n\n\n
  3. You can roll out this feature to a set of users, or to all the users using Group Policy.<\/li>\n<\/ol>\n\n\n\n

    How Seamless Single Sign On works<\/h4>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    Let\u2019s understand how Azure AD Seamless Single Sign-on works.<\/p>\n\n\n\n

    Important<\/strong>: When you enable Seamless SSO using Azure AD Connect, it creates a computer account object in on-premises Active Directory with name AZUREADSSOACC<\/strong> (Azure AD SSO Account). This account represents Azure Active Directory tenant. In addition to this, a Kerberos Service Principal Name is also created. This SPN is used during Azure AD sign-in process.<\/p>\n\n\n\n

    So let\u2019s understand how a user is authenticated using Azure AD Seamless Single Sign-on.<\/p>\n\n\n\n

      \n
    1. Let\u2019s assume a user is trying to access portal.office.com from a domain-joined machine.<\/li>\n\n\n\n
    2. Using JavaScript in the background, Azure AD will send a challenge to the browser (using 401 Un-authorized response) and it will ask to provide a Kerberos ticket.<\/li>\n\n\n\n
    3. Then browser will request a ticket from Active Directory for Azure AD SSO Account.<\/li>\n\n\n\n
    4. Then Active Directory will locate the computer account object. It will create a Kerberos ticket, it will encrypt this ticket using the secret key of Azure AD SSO Account, and will send the Kerberos ticket to the browser.<\/li>\n\n\n\n
    5. Browser will forward this Kerberos ticket to Azure Active Directory.<\/li>\n\n\n\n
    6. Azure AD will decrypt the Kerberos ticket, and will evaluate the identity that is included within the Kerberos ticket.<\/li>\n\n\n\n
    7. After successful evaluation, Azure AD will send a token to the application, and the user will login to the application.<\/li>\n<\/ol>\n\n\n\n

      In this entire process of Seamless SSO, the user did not enter his username or password. He simply typed portal.office.com in browser in domain-joined machine, and he was logged in.<\/p>\n\n\n\n

      Azure AD Seamless SSO prerequisites<\/h4>\n\n\n\n

      Now let\u2019s talk about the prerequisites for using Azure AD Seamless SSO.<\/p>\n\n\n\n

        \n
      1. You need to set up Azure AD Connect in on-premises using either Password Hash Synchronization or Pass-through Authentication.<\/li>\n\n\n\n
      2. You need to make sure that your are using the latest version of Azure AD Connect.<\/li>\n\n\n\n
      3. You need Admin credentials for Office 365 Tenant and on-premises Active Directory.<\/li>\n\n\n\n
      4. Before you enable Azure AD Seamless SSO, make sure\u00a0Modern Authentication<\/a>\u00a0is enabled in your Microsoft 365 tenant.<\/li>\n\n\n\n
      5. If you want to use SSO feature with Microsoft 365 clients (like, Outlook, Word or Excel), make sure you are using the latest version of these clients.<\/li>\n<\/ol>\n\n\n\n

        How to set up SSO with Azure AD<\/h4>\n\n\n\n

        Let\u2019s set up Azure AD Seamless SSO step by step.<\/p>\n\n\n\n

        Enable Seamless Single Sign-on using Microsoft Entra Connect<\/h5>\n\n\n\n

        To enable Seamless SSO using Azure AD Connect (Microsoft Entra Connect), open Azure AD Connect wizard, and on the Welcome<\/strong> page, click Configure<\/strong>.<\/p>\n\n\n\n

        On the Additional tasks<\/strong> page of Azure AD Connect wizard, select Change user sign-in<\/strong> and click Next<\/strong>.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        On the Connect to Azure AD<\/strong> page, type Azure AD Global Administrator credentials and click Next<\/strong>.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        On the User sign-in<\/strong> page, check Enable single sign-on<\/strong> option and click Next<\/strong>.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        On the Enable single sign-on<\/strong> page click Enter credentials<\/strong> and type on-premises Active Directory Enterprise Admin credentials and click Next<\/strong>.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        On the Ready to configure<\/strong> page, check Start the synchronization process when configuration completes<\/strong>, and click Configure<\/strong>.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        On the Configuration complete<\/strong> page click Exit<\/strong> to close the wizard.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n
        Verify Seamless SSO in Azure AD<\/h5>\n\n\n\n
        \"\"<\/figure>\n\n\n\n

        Go to Microsoft Entra Admin Center, click Hybrid management<\/strong>, click Microsoft Entra Connect<\/strong>, click Connect Sync<\/strong>. Verify that Seamless single sign-on<\/strong> is set to Enabled<\/strong>.<\/p>\n\n\n\n

        Roll out Seamless Single Sign-on using Group Policy<\/h5>\n\n\n\n

        In the next step we will create a group policy in on-premises Active Directory to roll out Seamless SSO to the users.<\/p>\n\n\n\n

        Open Group Policy Management<\/strong>, expand Forest: Domain.com<\/strong>, expand Domains<\/strong>, and expand your Active Directory domain as shown in below image:<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Right click Default Domain Policy<\/strong> and click Edit<\/strong>.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Expand User Configuration<\/strong> > Policies<\/strong> > Administrative Templates<\/strong> > Windows Components<\/strong> > Internet Explorer<\/strong> > Internet Control Panel<\/strong>, click Security Page<\/strong>, and double click Site to Zone Assignment List<\/strong>.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Set the policy to Enabled<\/strong> and click Show<\/strong>.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        On the Show Contents<\/strong> screen, under Value name<\/strong> type https:\/\/autologon.microsoftazuread-sso.com<\/strong> and under Value<\/strong> type 1<\/strong>. Click OK<\/strong> and click OK<\/strong> again.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Go to User Configuration<\/strong> > Policies<\/strong> > Administrative Templates<\/strong> > Windows Components<\/strong> > Internet Explorer<\/strong> > Internet Control Panel<\/strong> > Security Page<\/strong> > Intranet Zone<\/strong>, and double click Allow updates to status bar via script<\/strong>.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Set this policy to Enabled<\/strong> and click OK<\/strong>.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Go to User Configuration<\/strong> > Preferences<\/strong> > Windows Settings<\/strong>, right click Registry<\/strong> and click New<\/strong>.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Enter or select the following values as shown below, and then select OK<\/strong>.<\/p>\n\n\n\n

        Key Path<\/strong>: Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\microsoftazuread-sso.com\\autologon
        Value name<\/strong>: https
        Value type<\/strong>: REG_DWORD
        Value data<\/strong>: 00000001<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        That\u2019s it! You have successfully rolled out Azure AD Seamless SSO.<\/p>\n","protected":false},"excerpt":{"rendered":"

        What is Single Sign-on Azure AD Seamless Single Sign-on is a feature of Azure Active Directory that allows users to login to the applications without their usernames and passwords when … Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":83,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-62","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sarservice","entry"],"_links":{"self":[{"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/posts\/62","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/comments?post=62"}],"version-history":[{"count":1,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/posts\/62\/revisions"}],"predecessor-version":[{"id":82,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/posts\/62\/revisions\/82"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/media\/83"}],"wp:attachment":[{"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/media?parent=62"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/categories?post=62"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/tags?post=62"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}