Forum Discussion
Solved
Azure Active Directory Seamless Single Sign-On
I have a question around Azure Active Directory Seamless Single Sign-On.
So we want to use the Azure Seamless Single Sign-On but we have a forest and each business is in an organisation unit th...
sorry... then I guess your only option is trying multiple federated tenants, but I'm not sure it's supported
Will Mellor, this is actually possible, but not supported due to how the Azure AD Connect works. Technically, SSO is using Kerberos. This means that both the "server" account in AD and the "service" (Azure AD) must share the secret (see this doc).
When enabling SSO, Azure AD connect creates a computer account in AD (AZUREADSSOACC), service principalname (https://autologon.microsoftazuread-sso.com), and configures SSO in Azure AD. During this process, it creates a random password for AZUREADSSOACC and tells this to Azure AD.
So, if you could set the password for each tenant to be the same, this would work. With Microsoft tools, this is not possible. However, this feature will be introduced in the next version of my AADInternals PowerShell module after being presented and announced in T2'19 infosec conference.
Nestori SyynimaaThank you will keep a look out 