Forum Discussion

Copper Contributor

Feb 02, 2018

Solved

Azure Active Directory Seamless Single Sign-On

I have a question around Azure Active Directory Seamless Single Sign-On. So we want to use the Azure Seamless Single Sign-On but we have a forest and each business is in an organisation unit th...

azure active directory

Pablo R. Ortiz
Feb 02, 2018
sorry... then I guess your only option is trying multiple federated tenants, but I'm not sure it's supported

https://blog.kloud.com.au/2015/09/08/office-365-sso-configuring-multiple-office-365-tenants-to-use-a-single-ad-fs-instance/

Will Mellor

Copper Contributor

Feb 02, 2018

I thought that might be the case but I have also seen this: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-topologies#multiple-forests-single-azure-ad-tenant

In their says: The single sign-on (SSO) option for password synchronization and pass-through authentication can be used with only one Azure AD tenant.

I would take this as it is not possible.

Nestori Syynimaa

MVP

Oct 07, 2019

Will Mellor, this is actually possible, but not supported due to how the Azure AD Connect works. Technically, SSO is using Kerberos. This means that both the "server" account in AD and the "service" (Azure AD) must share the secret (see this doc).

When enabling SSO, Azure AD connect creates a computer account in AD (AZUREADSSOACC), service principalname (https://autologon.microsoftazuread-sso.com), and configures SSO in Azure AD. During this process, it creates a random password for AZUREADSSOACC and tells this to Azure AD.

So, if you could set the password for each tenant to be the same, this would work. With Microsoft tools, this is not possible. However, this feature will be introduced in the next version of my AADInternals PowerShell module after being presented and announced in T2'19 infosec conference.