Nov 02 2020 01:10 PM
Nov 02 2020 01:10 PM
We are trying to configure the Edge GPO to enable local sync of favorites, but we are unable to get the on-prem sign-in to work over VPN and so the local profile.pb is never created.
Our settings are as follows:
BrowserSignin = 1
ConfigureOnPremisesAccountAutoSignIn = 1
RoamingProfileSupportEnabled = 1
SyncDisabled = 0
When we login to Windows 10 with a cached credential, connect to VPN, and launch Edge with these settings, we get prompted to sign-in. The only account that seems to work is the "work or school account" which is our O365 email address. Signing in using this account results in the Edge account type and sync account type as AAD instead of on-prem and the message "sync isn't available for this account"
I believe the cause of the issue is the AD account is not being used to sign in to the browser even though ConfigureOnPremisesAccountAutoSignIn is set to 1. Doing a whoami at a command prompt shows my account name in domain\username format.
Using these same settings while logged into an on-site workstation results in on-premises sign in and sync working properly. Is there any reason why this functionality would not work on a cached local logon/VPN scenario?
Nov 06 2020 02:39 PM
@jdbst56 Hi Joshua! Thanks for reaching out! The Identity Team was looking over your post and it would be helpful to get logs to better understand your specific question/scenario.
Because of the sensitive information/PII that can be in the logs, there are a couple of options:
If you are planning to use the in-browser feedback tool please get into a clean state and log feedback only after the issue is reproduced. You can get into a clean state by 1) deleting User Data folder before launch OR 2) Create a separate folder and launching edge from command line using --user-data-dir=<that folder>
Additionally, to help the team find your feedback quickly, you can include the string "ForumIdentityOnPremisesVPN" and comment below once you've submitted it.
Nov 09 2020 09:03 AM
Nov 09 2020 09:27 AM
@Kelly_Y Hello, I have submitted the logs through the in-browser feedback tool today per your rquest.
Nov 09 2020 11:52 AM
@jdbst56 Thank you for the feedback! I've located your specific report and routed it to the Identity Team. We will follow up if there is any additional information needed or updates/insights to share.
Nov 09 2020 01:46 PM
@jdbst56 The team has investigated and can see from the feedback report submitted, on MS Edge launch, the user got signed in with the secondary AAD account on the machine.
ConfigureOnPremisesAccountAutoSignIn policy mentions that MS Edge will give preference to AAD accounts over on-premises account.
Enable the use of Active Directory accounts for automatic sign in if your users' machines are Domain Joined and your environment is not hybrid joined.
The behavior currently being experienced is to be expected and the change to use secondary account was made in MS Edge V86.
The current suggestion from the team is to consider removing the secondary AAD account from machine.
To provide a little more information, we are evaluating/investigating creating a new policy so users will not get implicit sign-in with secondary AAD account if ConfigureOnPremisesAccountAutoSignIn is configured.
@bin_da - Please take a look at this post and see if it helps your situation as well.
Nov 10 2020 08:45 AM
@Kelly_Y Thanks for your response.
So in our testing we saw that both AAD accounts and personal accounts are taking precedence over the on-premise AD account. We had to remove all traces of both accounts in order for the AD sync to work.
In our testing scenario, we removed the AAD account from Access work or school in Windows 10. After doing so and closing Edge, deleting the the User Data folder from AppData\Local\Microsoft\Edge and relaunching Edge, we found that the browser was then trying to sign in using personal gmail/hotmail accounts. We're not certain where these logins were coming from possibly the Microsoft Store or other Microsoft resources. On one system, signing out of all Microsoft resources and clearing the Edge User Data folder allowed the sign-in/sync using the AD account to work successfully. On another system, signing out of all resources and clearing Edge User Data folder did not resolve the signing with personal account. On this system we had to completely delete the Windows user profile to enable sign-in/sync with the on-premise AD account.
So in order to make this functionality viable for our enterprise, there needs to be the ability to force the sync to use on-premise AD account without the need of deleting the Edge User Data folder and/or Windows user profile.
Nov 10 2020 02:38 PM
@jdbst56 Thanks for following up with your testing results! The Identity Team has confirmed what you've seen is to be expected.
The auto sign-in policy works in this way:
In this case, once the AAD account was removed, step “3” took place. So like you noticed it is necessary to remove all of the MSA and AAD accounts from settings.
We appreciate your feedback! It is helpful to hear directly from users as they are investigating the new policy.
Nov 11 2020 03:56 PM
@Kelly_Y Do you have any timeframe for this:
"To provide a little more information, we are evaluating/investigating creating a new policy so users will not get implicit sign-in with secondary AAD account if ConfigureOnPremisesAccountAutoSignIn is configured."
Nov 11 2020 04:08 PM
@benhealy Hello! Sorry, no ETA yet. I can follow up here once we have updates to share.
Is this blocking the adoption or deployment of MS Edge in your organization?
Nov 11 2020 04:24 PM
@Kelly_Y Yes it is stopping us deploying currently.
Our Windows 10 devices are hybrid joined and our Security/Architecture team are not endorsing cloud sync. As On-Premises sync doesn't work with this setup, if we roll out our users will be forced to export and import their bookmarks whenever they log into a new computer or get re-imaged. Not as user friendly as they are used to with Favourites and folder redirection.
Nov 11 2020 04:31 PM
@benhealy Thank you! I've passed this information on to the team.
Nov 23 2020 06:11 AM
@Kelly_Y Hi, Do you have any update on when we can expect a new GPO setting to force on-prem account sign-in?
Nov 23 2020 01:52 PM
@jdbst56 Hi! Still no ETA but we’ll keep you updated when we know more! Thanks!
Nov 30 2020 08:05 AM
"The current suggestion from the team is to consider removing the secondary AAD account from machine."
Our machines are not hybrid joined - we also see this behaviour (Edge not recognizing on-prem sync) even on Servers not having Office 365 installed.
Jan 06 2021 10:05 AM
@So_224 Hi! No updates from the team yet but we will follow up here with information. Thanks!
Mar 05 2021 12:52 PM
Mar 05 2021 12:54 PM