Merge pull request #102516 from billmath/sso

Sso

Author: megvanhuygen

articles/active-directory/cloud-provisioning/TOC.yml

@@ -42,6 +42,8 @@
       href: how-to-install.md
     - name: Cloud provisioning configuration
       href: how-to-configure.md
+    - name: Use Single Sign-On
+      href: how-to-sso.md
   - name: Plan and design
     items:
     - name: Topologies and scenarios for Azure AD Connect cloud provisioning

articles/active-directory/cloud-provisioning/how-to-sso.md

@@ -0,0 +1,28 @@
+---
+title: 'How to use Single Sign-on with cloud provisioning'
+description: This article describes how to install and use sso with cloud provisioning.
+services: active-directory
+author: billmath
+manager: daveba
+ms.service: active-directory
+ms.workload: identity
+ms.topic: conceptual
+ms.date: 01/28/2020
+ms.subservice: hybrid
+ms.author: billmath
+ms.collection: M365-identity-device-management
+---
+
+# Using Single Sign-On with cloud provisioning
+The following document describes how to use single sign-on with cloud provisioning.
+
+[!INCLUDE [active-directory-cloud-provisioning-sso.md](../../../includes/active-directory-cloud-provisioning-sso.md)]
+
+
+
+
+
+## Next steps 
+
+- [What is provisioning?](what-is-provisioning.md)
+- [What is Azure AD Connect cloud provisioning?](what-is-cloud-provisioning.md)

includes/active-directory-cloud-provisioning-sso.md

@@ -0,0 +1,45 @@
+---
+author: billmath
+ms.service: active-directory
+ms.subservice: cloud-provisioning
+ms.topic: include
+ms.date: 10/16/2019
+ms.author: billmath
+# Used by articles that require an SSO workaround.
+---
+
+## Steps to enable Single Sign-on
+Cloud provisioning works with Single Sign-on.  Currently their is not an option to enable SSO when the agent is installed, however you can use the steps below to enable SSO and use it. 
+
+### Step 1: Download and extract Azure AD Connect files
+1.  First, download the latest version of [Azure AD Connect](https://www.microsoft.com/download/details.aspx?id=47594)
+2.  Open a command prompt using Administrative privileges and navigate to the msi you just downloaded.
+3.  Run the following:  `msiexec /a C:\filepath\AzureADConnect.msi /qb TARGETDIR=C:\filepath\extractfolder`
+4. Change filepath and extractfolder to match your file path and the name of your extraction folder.  The contents should now be in the extraction folder.
+
+### Step 2: Import the Seamless SSO PowerShell module
+
+1. Download, and install [Azure AD PowerShell](https://docs.microsoft.com/powershell/azure/active-directory/overview).
+2. Browse to the `%programfiles%\Microsoft Azure Active Directory Connect` folder.
+3. Import the Seamless SSO PowerShell module by using this command: `Import-Module .\AzureADSSO.psd1`.
+
+### Step 3: Get the list of Active Directory forests on which Seamless SSO has been enabled
+
+1. Run PowerShell as an administrator. In PowerShell, call `New-AzureADSSOAuthenticationContext`. When prompted, enter your tenant's global administrator credentials.
+2. Call `Get-AzureADSSOStatus`. This command provides you with the list of Active Directory forests (look at the "Domains" list) on which this feature has been enabled.
+
+### Step 4: Enable Seamless SSO for each Active Directory forest
+
+1. Call `Enable-AzureADSSOForest`. When prompted, enter the domain administrator credentials for the intended Active Directory forest.
+
+   > [!NOTE]
+   >The domain administrator credentials username must be entered in the SAM account name format  (contoso\johndoe or contoso.com\johndoe). We use the domain portion of the username to locate the Domain Controller of the Domain Administrator using DNS.
+
+   >[!NOTE]
+   >The domain administrator account used must not be a member of the Protected Users group. If so, the operation will fail.
+
+2. Repeat the preceding step for each Active Directory forest where you want to set up the feature.
+
+### Step 5. Enable the feature on your tenant
+
+To turn on the feature on your tenant, call `Enable-AzureADSSO -Enable $true`.