You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Enforce Azure AD password protection for Windows Server Active Directory
19
19
20
-
Azure AD password protection is a feature that enhances password policies in an organization. On-premises deployment of password protection uses both the global and custom banned-password lists that are stored in Azure AD. It does the same checks on-premises as Azure AD for cloud-based changes.
20
+
Azure AD password protection is a feature that enhances password policies in an organization. On-premises deployment of password protection uses both the global and custom banned-password lists that are stored in Azure AD. It does the same checks on-premises as Azure AD does for cloud-based changes. These checks are performed during password changes and password reset scenarios.
Copy file name to clipboardExpand all lines: articles/active-directory/conditional-access/howto-conditional-access-policy-block-legacy.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,7 +21,7 @@ Due to the increased risk associated with legacy authentication protocols, Micro
21
21
22
22
## Create a Conditional Access policy
23
23
24
-
The following steps will help create a Conditional Access policy to require those assigned administrative roles to perform multi-factor authentication.
24
+
The following steps will help create a Conditional Access policy to block legacy authentication requests.
25
25
26
26
1. Sign in to the **Azure portal** as a global administrator, security administrator, or Conditional Access administrator.
27
27
1. Browse to **Azure Active Directory** > **Conditional Access**.
Copy file name to clipboardExpand all lines: articles/active-directory/develop/howto-app-gallery-listing.md
+12-6Lines changed: 12 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -77,7 +77,7 @@ To list an application in the Azure AD app gallery, you first need to implement
77
77
78
78
79
79
* If you want to add your application to list in the gallery using OpenID Connect, select **OpenID Connect & OAuth 2.0** as above.
80
-
* If you have any issues regarding access, contact the [Azure AD SSO Integration Team](<mailto:[email protected]>).
80
+
* If you have any issues regarding access, contact the [Azure AD SSO Integration Team](<mailto:[email protected]>).
81
81
82
82
-**SAML 2.0** or **WS-Fed**: If your app supports SAML 2.0, you can integrate it directly with an Azure AD tenant by using the [instructions to add a custom application](../active-directory-saas-custom-apps.md).
83
83
@@ -95,6 +95,12 @@ Create a web application that has an HTML sign-in page to configure [password-ba
95
95
* If you want to add your application to list in the gallery using Password SSO, select **Password SSO** as above.
96
96
* If you have any issues regarding access, contact the [Azure AD SSO Integration Team](<mailto:[email protected]>).
97
97
98
+
## Requesting for User Provisioning
99
+
100
+
Follow the below process to request for user provisioning-
101
+
102
+
103
+
98
104
## Update/Remove existing listing
99
105
100
106
To update or remove an existing application in the Azure AD app gallery, you first need to submit the request in the [Application Network Portal](https://microsoft.sharepoint.com/teams/apponboarding/Apps). If you have an Office 365 account, use that to sign in to this portal. If not, use your Microsoft account (such as Outlook or Hotmail) to sign in.
@@ -103,9 +109,9 @@ To update or remove an existing application in the Azure AD app gallery, you fir
103
109
104
110
105
111
106
-
* If you want to update an existing application, select **Update existing application listing**.
107
-
* If you want to remove an existing application from the Azure AD gallery, select **Remove existing application listing**.
108
-
* If you have any issues regarding access, contact the [Azure AD SSO Integration Team](<mailto:[email protected]>).
112
+
* If you want to update an existing application, select appropriate option as per your requirement.
113
+
* If you want to remove an existing application from the Azure AD gallery, select **Remove my application listing from the gallery**.
114
+
* If you have any issues regarding access, contact the [Azure AD SSO Integration Team](<mailto:[email protected]>).
109
115
110
116
## Listing requests by customers
111
117
@@ -121,11 +127,11 @@ Below is the flow of customer requested applications-
121
127
122
128
The timeline for the process of listing a SAML 2.0 or WS-Fed application in the gallery is 7-10 business days.
123
129
124
-
130
+
125
131
126
132
The timeline for the process of listing an OpenID Connect application in the gallery is 2-5 business days.
127
133
128
-
134
+
In this article, we address frequently asked questions about Azure Active Directory Seamless Single Sign-On (Seamless SSO). Keep checking back for new content.
24
24
25
-
##What sign-in methods do Seamless SSO work with?
25
+
**Q: What sign-in methods do Seamless SSO work with**
26
26
27
27
Seamless SSO can be combined with either the [Password Hash Synchronization](how-to-connect-password-hash-synchronization.md) or [Pass-through Authentication](how-to-connect-pta.md) sign-in methods. However this feature cannot be used with Active Directory Federation Services (ADFS).
28
28
29
-
##Is Seamless SSO a free feature?
29
+
**Q: Is Seamless SSO a free feature?**
30
30
31
31
Seamless SSO is a free feature and you don't need any paid editions of Azure AD to use it.
32
32
33
-
##Is Seamless SSO available in the [Microsoft Azure Germany cloud](https://www.microsoft.de/cloud-deutschland) and the [Microsoft Azure Government cloud](https://azure.microsoft.com/features/gov/)?
33
+
**Q: Is Seamless SSO available in the [Microsoft Azure Germany cloud](https://www.microsoft.de/cloud-deutschland) and the [Microsoft Azure Government cloud](https://azure.microsoft.com/features/gov/)?**
34
34
35
35
No. Seamless SSO is only available in the worldwide instance of Azure AD.
36
36
37
-
##What applications take advantage of `domain_hint` or `login_hint` parameter capability of Seamless SSO?
37
+
**Q: What applications take advantage of `domain_hint` or `login_hint` parameter capability of Seamless SSO?**
38
38
39
39
Listed below is a non-exhaustive list of applications that can send these parameters to Azure AD, and therefore provides users a silent sign-on experience using Seamless SSO (i.e., no need for your users to input their usernames or passwords):
40
40
@@ -55,21 +55,21 @@ In the above tables, replace "contoso.com" with your domain name to get to the r
55
55
56
56
If you want other applications using our silent sign-on experience, let us know in the feedback section.
57
57
58
-
##Does Seamless SSO support `Alternate ID` as the username, instead of `userPrincipalName`?
58
+
**Q: Does Seamless SSO support `Alternate ID` as the username, instead of `userPrincipalName`?**
59
59
60
60
Yes. Seamless SSO supports `Alternate ID` as the username when configured in Azure AD Connect as shown [here](how-to-connect-install-custom.md). Not all Office 365 applications support `Alternate ID`. Refer to the specific application's documentation for the support statement.
61
61
62
-
##What is the difference between the single sign-on experience provided by [Azure AD Join](../active-directory-azureadjoin-overview.md) and Seamless SSO?
62
+
**Q: What is the difference between the single sign-on experience provided by [Azure AD Join](../active-directory-azureadjoin-overview.md) and Seamless SSO?**
63
63
64
64
[Azure AD Join](../active-directory-azureadjoin-overview.md) provides SSO to users if their devices are registered with Azure AD. These devices don't necessarily have to be domain-joined. SSO is provided using *primary refresh tokens* or *PRTs*, and not Kerberos. The user experience is most optimal on Windows 10 devices. SSO happens automatically on the Microsoft Edge browser. It also works on Chrome with the use of a browser extension.
65
65
66
66
You can use both Azure AD Join and Seamless SSO on your tenant. These two features are complementary. If both features are turned on, then SSO from Azure AD Join takes precedence over Seamless SSO.
67
67
68
-
##I want to register non-Windows 10 devices with Azure AD, without using AD FS. Can I use Seamless SSO instead?
68
+
**Q: I want to register non-Windows 10 devices with Azure AD, without using AD FS. Can I use Seamless SSO instead?**
69
69
70
70
Yes, this scenario needs version 2.1 or later of the [workplace-join client](https://www.microsoft.com/download/details.aspx?id=53554).
71
71
72
-
##How can I roll over the Kerberos decryption key of the `AZUREADSSOACC` computer account?
72
+
**Q: How can I roll over the Kerberos decryption key of the `AZUREADSSOACC` computer account?**
73
73
74
74
It is important to frequently roll over the Kerberos decryption key of the `AZUREADSSOACC` computer account (which represents Azure AD) created in your on-premises AD forest.
75
75
@@ -78,66 +78,66 @@ It is important to frequently roll over the Kerberos decryption key of the `AZUR
78
78
79
79
Follow these steps on the on-premises server where you are running Azure AD Connect:
80
80
81
-
### Step 1. Get list of AD forests where Seamless SSO has been enabled
81
+
**Step 1. Get list of AD forests where Seamless SSO has been enabled**
82
82
83
-
1. First, download, and install [Azure AD PowerShell](https://docs.microsoft.com/powershell/azure/active-directory/overview).
84
-
2. Navigate to the `%programfiles%\Microsoft Azure Active Directory Connect` folder.
85
-
3. Import the Seamless SSO PowerShell module using this command: `Import-Module .\AzureADSSO.psd1`.
86
-
4. Run PowerShell as an Administrator. In PowerShell, call `New-AzureADSSOAuthenticationContext`. This command should give you a popup to enter your tenant's Global Administrator credentials.
87
-
5. Call `Get-AzureADSSOStatus | ConvertFrom-Json`. This command provides you the list of AD forests (look at the "Domains" list) on which this feature has been enabled.
83
+
1. First, download, and install [Azure AD PowerShell](https://docs.microsoft.com/powershell/azure/active-directory/overview).
84
+
2. Navigate to the `%programfiles%\Microsoft Azure Active Directory Connect` folder.
85
+
3. Import the Seamless SSO PowerShell module using this command: `Import-Module .\AzureADSSO.psd1`.
86
+
4. Run PowerShell as an Administrator. In PowerShell, call `New-AzureADSSOAuthenticationContext`. This command should give you a popup to enter your tenant's Global Administrator credentials.
87
+
5. Call `Get-AzureADSSOStatus | ConvertFrom-Json`. This command provides you the list of AD forests (look at the "Domains" list) on which this feature has been enabled.
88
88
89
-
### Step 2. Update the Kerberos decryption key on each AD forest that it was set it up on
89
+
**Step 2. Update the Kerberos decryption key on each AD forest that it was set it up on**
90
90
91
-
1. Call `$creds = Get-Credential`. When prompted, enter the Domain Administrator credentials for the intended AD forest.
91
+
1. Call `$creds = Get-Credential`. When prompted, enter the Domain Administrator credentials for the intended AD forest.
92
92
93
-
> [!NOTE]
94
-
> We use the Domain Administrator's username, provided in the User Principal Names (UPN) ([email protected]) format or the domain qualified sam-account name (contoso\johndoe or contoso.com\johndoe) format, to find the intended AD forest. If you use domain qualified sam-account name, we use the domain portion of the username to [locate the Domain Controller of the Domain Administrator using DNS](https://social.technet.microsoft.com/wiki/contents/articles/24457.how-domain-controllers-are-located-in-windows.aspx). If you use UPN instead, we [translate it to a domain qualified sam-account name](https://docs.microsoft.com/windows/desktop/api/ntdsapi/nf-ntdsapi-dscracknamesa) before locating the appropriate Domain Controller.
93
+
> [!NOTE]
94
+
> We use the Domain Administrator's username, provided in the User Principal Names (UPN) ([email protected]) format or the domain qualified sam-account name (contoso\johndoe or contoso.com\johndoe) format, to find the intended AD forest. If you use domain qualified sam-account name, we use the domain portion of the username to [locate the Domain Controller of the Domain Administrator using DNS](https://social.technet.microsoft.com/wiki/contents/articles/24457.how-domain-controllers-are-located-in-windows.aspx). If you use UPN instead, we [translate it to a domain qualified sam-account name](https://docs.microsoft.com/windows/desktop/api/ntdsapi/nf-ntdsapi-dscracknamesa) before locating the appropriate Domain Controller.
95
95
96
-
2. Call `Update-AzureADSSOForest -OnPremCredentials $creds`. This command updates the Kerberos decryption key for the `AZUREADSSOACC` computer account in this specific AD forest and updates it in Azure AD.
97
-
3. Repeat the preceding steps for each AD forest that you’ve set up the feature on.
96
+
2. Call `Update-AzureADSSOForest -OnPremCredentials $creds`. This command updates the Kerberos decryption key for the `AZUREADSSOACC` computer account in this specific AD forest and updates it in Azure AD.
97
+
3. Repeat the preceding steps for each AD forest that you’ve set up the feature on.
98
98
99
-
>[!IMPORTANT]
100
-
>Ensure that you _don't_ run the `Update-AzureADSSOForest` command more than once. Otherwise, the feature stops working until the time your users' Kerberos tickets expire and are reissued by your on-premises Active Directory.
99
+
>[!IMPORTANT]
100
+
>Ensure that you _don't_ run the `Update-AzureADSSOForest` command more than once. Otherwise, the feature stops working until the time your users' Kerberos tickets expire and are reissued by your on-premises Active Directory.
101
101
102
-
##How can I disable Seamless SSO?
102
+
**Q: How can I disable Seamless SSO?**
103
103
104
-
### Step 1. Disable the feature on your tenant
104
+
**Step 1. Disable the feature on your tenant**
105
105
106
-
#### Option A: Disable using Azure AD Connect
106
+
**Option A: Disable using Azure AD Connect**
107
107
108
-
1. Run Azure AD Connect, choose **Change user sign-in page** and click **Next**.
109
-
2. Uncheck the **Enable single sign on** option. Continue through the wizard.
108
+
1. Run Azure AD Connect, choose **Change user sign-in page** and click **Next**.
109
+
2. Uncheck the **Enable single sign on** option. Continue through the wizard.
110
110
111
-
After completing the wizard, Seamless SSO will be disabled on your tenant. However, you will see a message on screen that reads as follows:
111
+
After completing the wizard, Seamless SSO will be disabled on your tenant. However, you will see a message on screen that reads as follows:
112
112
113
-
"Single sign-on is now disabled, but there are additional manual steps to perform in order to complete clean-up. Learn more"
113
+
"Single sign-on is now disabled, but there are additional manual steps to perform in order to complete clean-up. Learn more"
114
114
115
-
To complete the clean-up process, follow steps 2 and 3 on the on-premises server where you are running Azure AD Connect.
115
+
To complete the clean-up process, follow steps 2 and 3 on the on-premises server where you are running Azure AD Connect.
116
116
117
-
#### Option B: Disable using PowerShell
117
+
**Option B: Disable using PowerShell**
118
118
119
-
Run the following steps on the on-premises server where you are running Azure AD Connect:
119
+
Run the following steps on the on-premises server where you are running Azure AD Connect:
120
120
121
-
1. First, download, and install [Azure AD PowerShell](https://docs.microsoft.com/powershell/azure/active-directory/overview).
122
-
2. Navigate to the `%programfiles%\Microsoft Azure Active Directory Connect` folder.
123
-
3. Import the Seamless SSO PowerShell module using this command: `Import-Module .\AzureADSSO.psd1`.
124
-
4. Run PowerShell as an Administrator. In PowerShell, call `New-AzureADSSOAuthenticationContext`. This command should give you a popup to enter your tenant's Global Administrator credentials.
125
-
5. Call `Enable-AzureADSSO -Enable $false`.
121
+
1. First, download, and install [Azure AD PowerShell](https://docs.microsoft.com/powershell/azure/active-directory/overview).
122
+
2. Navigate to the `%programfiles%\Microsoft Azure Active Directory Connect` folder.
123
+
3. Import the Seamless SSO PowerShell module using this command: `Import-Module .\AzureADSSO.psd1`.
124
+
4. Run PowerShell as an Administrator. In PowerShell, call `New-AzureADSSOAuthenticationContext`. This command should give you a popup to enter your tenant's Global Administrator credentials.
125
+
5. Call `Enable-AzureADSSO -Enable $false`.
126
126
127
-
>[!IMPORTANT]
128
-
>Disabling Seamless SSO using PowerShell will not change the state in Azure AD Connect. Seamless SSO will show as enabled in the **Change user sign-in** page.
127
+
>[!IMPORTANT]
128
+
>Disabling Seamless SSO using PowerShell will not change the state in Azure AD Connect. Seamless SSO will show as enabled in the **Change user sign-in** page.
129
129
130
-
### Step 2. Get list of AD forests where Seamless SSO has been enabled
130
+
**Step 2. Get list of AD forests where Seamless SSO has been enabled**
131
131
132
-
Follow tasks 1 through 4 below if you have disabled Seamless SSO using Azure AD Connect. If you have disabled Seamless SSO using PowerShell instead, jump ahead to task 5 below.
132
+
Follow tasks 1 through 4 below if you have disabled Seamless SSO using Azure AD Connect. If you have disabled Seamless SSO using PowerShell instead, jump ahead to task 5 below.
133
133
134
-
1. First, download, and install [Azure AD PowerShell](https://docs.microsoft.com/powershell/azure/active-directory/overview).
135
-
2. Navigate to the `%programfiles%\Microsoft Azure Active Directory Connect` folder.
136
-
3. Import the Seamless SSO PowerShell module using this command: `Import-Module .\AzureADSSO.psd1`.
137
-
4. Run PowerShell as an Administrator. In PowerShell, call `New-AzureADSSOAuthenticationContext`. This command should give you a popup to enter your tenant's Global Administrator credentials.
138
-
5. Call `Get-AzureADSSOStatus | ConvertFrom-Json`. This command provides you the list of AD forests (look at the "Domains" list) on which this feature has been enabled.
134
+
1. First, download, and install [Azure AD PowerShell](https://docs.microsoft.com/powershell/azure/active-directory/overview).
135
+
2. Navigate to the `%programfiles%\Microsoft Azure Active Directory Connect` folder.
136
+
3. Import the Seamless SSO PowerShell module using this command: `Import-Module .\AzureADSSO.psd1`.
137
+
4. Run PowerShell as an Administrator. In PowerShell, call `New-AzureADSSOAuthenticationContext`. This command should give you a popup to enter your tenant's Global Administrator credentials.
138
+
5. Call `Get-AzureADSSOStatus | ConvertFrom-Json`. This command provides you the list of AD forests (look at the "Domains" list) on which this feature has been enabled.
139
139
140
-
### Step 3. Manually delete the `AZUREADSSOACCT` computer account from each AD forest that you see listed.
140
+
**Step 3. Manually delete the `AZUREADSSOACCT` computer account from each AD forest that you see listed.**
0 commit comments