Forum Discussion
Will Mellor
Feb 02, 2018Copper Contributor
Azure Active Directory Seamless Single Sign-On
I have a question around Azure Active Directory Seamless Single Sign-On.
So we want to use the Azure Seamless Single Sign-On but we have a forest and each business is in an organisation unit then each organisation unit is connected to their own office 365 tenant for each business via Azure AD Connect. Would we be able to use Azure Active Directory Seamless Single Sign-On for all the businesses that have separate tenants ?
sorry... then I guess your only option is trying multiple federated tenants, but I'm not sure it's supported
- Pablo R. OrtizSteel Contributor
I don't see any limitation for your scenario:
https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-sso
You could face problems when you sync 30 or more AD forests, which is not your case:
Just follow the procedure for each tenant:
- Will MellorCopper ContributorI thought that might be the case but I have also seen this: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-topologies#multiple-forests-single-azure-ad-tenant
In their says: The single sign-on (SSO) option for password synchronization and pass-through authentication can be used with only one Azure AD tenant.
I would take this as it is not possible.Will Mellor, this is actually possible, but not supported due to how the Azure AD Connect works. Technically, SSO is using Kerberos. This means that both the "server" account in AD and the "service" (Azure AD) must share the secret (see this doc).
When enabling SSO, Azure AD connect creates a computer account in AD (AZUREADSSOACC), service principalname (https://autologon.microsoftazuread-sso.com), and configures SSO in Azure AD. During this process, it creates a random password for AZUREADSSOACC and tells this to Azure AD.
So, if you could set the password for each tenant to be the same, this would work. With Microsoft tools, this is not possible. However, this feature will be introduced in the next version of my AADInternals PowerShell module after being presented and announced in T2'19 infosec conference.