Azure AAD joined only Access on prem resource

Question

Hi,&nbsp;I have the following situation, i have an Azure AVD host that is joined to Azure AD only.&nbsp;From the dsregcmd /status: i have the following.Device State:+----------------------------------------------------------------------+| Device State &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |+----------------------------------------------------------------------+&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;AzureAdJoined : YES&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; EnterpriseJoined : NO&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; DomainJoined : NO&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Virtual Desktop : NOT SET&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Device Name : COMPUTERNAME+----------------------------------------------------------------------+| SSO State &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|+----------------------------------------------------------------------+&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; AzureAdPrt : YES&nbsp; &nbsp; &nbsp; AzureAdPrtUpdateTime : 2025-02-13 12:57:47.000 UTC&nbsp; &nbsp; &nbsp; AzureAdPrtExpiryTime : 2025-02-27 14:22:41.000 UTC&nbsp;+----------------------------------------------------------------------+| Diagnostic Data &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|+----------------------------------------------------------------------+&nbsp; &nbsp; &nbsp; &nbsp; AadRecoveryEnabled : NO&nbsp; &nbsp; Executing Account Name : DOMAINNAME\samaccount, FQDN&nbsp;+----------------------------------------------------------------------+| Ngc Prerequisite Check &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |+----------------------------------------------------------------------+&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; IsDeviceJoined : YES&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;IsUserAzureAD : YES&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;PolicyEnabled : YES&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PostLogonEnabled : YES&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; DeviceEligible : NO&nbsp; &nbsp; &nbsp; &nbsp; SessionIsNotRemote : NO&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CertEnrollment : none&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PreReqResult : WillNotProvision&nbsp;However when i connect to the on prem resource i get an authetnication prompt when i type in my username and password i can access the share.I do not get a kerberos ticket back.Klist remains empty. (cached tickets 0)&nbsp;It's not clear to me if it is required to have the cloud kerberos trust enabled if you don't use window hello for business or passwordles authentication.https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-passwordless-security-key-on-premises#rotate-the-azure-ad-kerberos-server-key?WT.mc_id=ES-MVP-5004117https://www.tbone.se/2023/02/03/azure-ad-kerberos/&nbsp;Do i need the Kerberos object in AD even i don't use keyless or hello for business.Anybody that can help on this?&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

micheleariis · Answer

Hi, it appears that your Azure AD–joined device isn’t obtaining a Kerberos ticket when accessing on-prem resources because the cloud Kerberos trust isn’t set up. Even if you're not using Windows Hello for Business or passwordless authentication, seamless Kerberos SSO to on-prem resources still requires a properly configured Kerberos object in AD.

In other words, if you want your device to obtain a Kerberos ticket and avoid credential prompts, you'll need to configure the cloud Kerberos trust. Without this configuration, your device won’t automatically receive a Kerberos ticket and will likely fall back to NTLM or prompt for credentials.

I hope this clarifies the situation.

elenamia · Answer

Hello, it seems that your Azure AD–joined device is unable to acquire a Kerberos ticket when attempting to access on-premises resources. This issue likely stems from the absence of a configured cloud Kerberos trust. Please note that, regardless of whether Windows Hello for Business or passwordless authentication is in use, seamless Kerberos-based single sign-on to on-premises resources still necessitates a correctly configured Kerberos object in Active Directory. https://www.damcogroup.com

Forum Discussion

Azure AAD joined only Access on prem resource

2 Replies