Skip to content

Commit a475dc7

Browse files
denreadenrea
committed
edit pass: reference-connect-government-cloud
1 parent ebc0eb3 commit a475dc7

File tree

1 file changed

+78
-58
lines changed

1 file changed

+78
-58
lines changed

‎articles/active-directory/hybrid/reference-connect-government-cloud.md

Lines changed: 78 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: 'Azure AD Connect: Hybrid identity considerations for Azure Government'
3-
description: Special considerations for deploying Azure AD Connect with the government cloud.
2+
title: 'Azure AD Connect: Hybrid identity considerations for Azure Government cloud'
3+
description: Special considerations for deploying Azure AD Connect with the Azure Government cloud.
44
services: active-directory
55
author: billmath
66
manager: daveba
@@ -13,68 +13,88 @@ ms.author: billmath
1313
ms.collection: M365-identity-device-management
1414
---
1515

16-
# Hybrid identity considerations for Azure Government
17-
The following document describes the considerations for implementing a hybrid environment with the Azure Government cloud. This information is provided as reference for administrators and architects who are working with the Azure Government cloud.
18-
> [!NOTE]
19-
> In order to integrate an on-premises AD environment with the Azure Governemnt cloud, you need to upgrade to the latest release of [Azure AD Connect](https://www.microsoft.com/download/details.aspx?id=47594).
16+
# Hybrid identity considerations for the Azure Government cloud
2017

21-
> [!NOTE]
22-
> For a full list of U.S. Government DoD Endpoints, refer to the [documentation](https://docs.microsoft.com/office365/enterprise/office-365-u-s-government-dod-endpoints)
18+
This article describes considerations for integrating a hybrid environment with the Microsoft Azure Government cloud. This information is provided as a reference for administrators and architects who work with the Azure Government cloud.
2319

24-
## Pass-Through Authentication
25-
The following information is provided for implementation of pass-through authentication (PTA) and the Azure Government cloud.
20+
> [!NOTE]
21+
> To integrate an on-premises Microsoft Azure Active Directory (Azure AD) environment with the Azure Government cloud, you need to upgrade to the latest release of [Azure AD Connect](https://www.microsoft.com/download/details.aspx?id=47594).
22+
23+
> [!NOTE]
24+
> For a full list of United States government Department of Defense endpoints, refer to the [documentation](https://docs.microsoft.com/office365/enterprise/office-365-u-s-government-dod-endpoints).
25+
26+
## Azure AD Pass-through Authentication
27+
28+
The following information describes implementation of Azure AD Pass-through Authentication and the Azure Government cloud.
29+
30+
### Allow access to URLs
31+
32+
Before deploying the Pass-through Authentication agent, verify whether a firewall exists between your servers and Azure AD. If your firewall or proxy allows Domain Name System (DNS) whitelisting, add the following connections.
2633

27-
### Allow access to URLs
28-
Before deploying the pass-through authentication agent, verify if there is a firewall between your servers and Azure AD. If your firewall or proxy allows DNS whitelisting, add the following connections:
2934
> [!NOTE]
30-
> The following guidance also applies to installing the [Application Proxy connector](https://aka.ms/whyappproxy) for Azure Government environments.
35+
> The following guidance also applies to installing the [Azure AD Application Proxy connector](https://aka.ms/whyappproxy) for Azure Government environments.
3136
3237
|URL |How it's used|
33-
|-----|-----|
34-
|*.msappproxy.us *.servicebus.usgovcloudapi.net|Communication between the agent and the Azure AD cloud service |
35-
|mscrl.microsoft.us:80 crl.microsoft.us:80 </br>ocsp.msocsp.us:80 www.microsoft.us:80| The agent uses these URLs to verify certificates.|
36-
|login.windows.us secure.aadcdn.microsoftonline-p.com *.microsoftonline.us </br>*.microsoftonline-p.us </br>*.msauth.net </br>*.msauthimages.net </br>*.msecnd.net</br>*.msftauth.net </br>*.msftauthimages.net</br>*.phonefactor.net </br>enterpriseregistration.windows.net</br>management.azure.com </br>policykeyservice.dc.ad.msft.net</br>ctdl.windowsupdate.us:80| The agent uses these URLs during the registration process.|
37-
38-
### Install the agent for the Azure Government cloud
39-
In order to install the agent for the Azure Government cloud, you must follow these specific steps:
40-
In the command line terminal, navigate to folder where the executable for installing the agent is located.
41-
Run the following command which specifies the installation is for Azure Government.
42-
43-
For Passthrough Authentication:
44-
```
45-
AADConnectAuthAgentSetup.exe ENVIRONMENTNAME="AzureUSGovernment"
46-
```
47-
48-
For Application Proxy:
49-
```
50-
AADApplicationProxyConnectorInstaller.exe ENVIRONMENTNAME="AzureUSGovernment"
51-
```
52-
53-
## Single sign on
54-
Set up your Azure AD Connect server: If you use Pass-through Authentication as your sign-in method, no additional prerequisite check is required. If you use password hash synchronization as your sign-in method, and if there is a firewall between Azure AD Connect and Azure AD, ensure that:
55-
- You use version 1.1.644.0 or later of Azure AD Connect.
56-
- If your firewall or proxy allows DNS whitelisting, add the connections to the *.msapproxy.us URLs over port 443. If not, allow access to the Azure datacenter IP ranges, which are updated weekly. This prerequisite is applicable only when you enable the feature. It is not required for actual user sign-ins.
57-
58-
### Rolling out seamless SSO
59-
You can gradually roll out Seamless SSO to your users using the instructions provided below. You start by adding the following Azure AD URL to all or selected users' Intranet zone settings by using Group Policy in Active Directory:
60-
https://autologon.microsoft.us
61-
62-
In addition, you need to enable an Intranet zone policy setting called Allow updates to status bar via script through Group Policy.
63-
Browser considerations
64-
Mozilla Firefox (all platforms)
65-
Mozilla Firefox doesn't automatically use Kerberos authentication. Each user must manually add the Azure AD URL to their Firefox settings by using the following steps:
66-
1. Run Firefox and enter about:config in the address bar. Dismiss any notifications that you see.
67-
2. Search for the network.negotiate-auth.trusted-uris preference. This preference lists Firefox's trusted sites for Kerberos authentication.
68-
3. Right-click and select Modify.
69-
4. Enter https://autologon.microsoft.us in the field.
70-
5. Select OK and then reopen the browser.
71-
72-
### Microsoft Edge based on Chromium (all platforms)
73-
If you have overridden the `AuthNegotiateDelegateAllowlist` or the `AuthServerAllowlist` policy settings in your environment, ensure that you add Azure AD's URL (https://autologon.microsoft.us) to them as well.
74-
75-
### Google Chrome (all platforms)
76-
If you have overridden the `AuthNegotiateDelegateWhitelist` or the `AuthServerWhitelist` policy settings in your environment, ensure that you add Azure AD's URL (https://autologon.microsoft.us) to them as well.
38+
|-----|-----|
39+
|.msappproxy.us</br>.servicebus.usgovcloudapi.net|The agent uses these URLs to communicate with the Azure AD Cloud Service. |
40+
|mscrl.microsoft.us:80 </br>crl.microsoft.us:80 </br>ocsp.msocsp.us:80 </br>www.microsoft.us:80| The agent uses these URLs to verify certificates.|
41+
|login.windows.us </br>secure.aadcdn.microsoftonline-p.com </br>.microsoftonline.us </br>.microsoftonline-p.us </br>.msauth.net </br>.msauthimages.net </br>.msecnd.net</br>.msftauth.net </br>.msftauthimages.net</br>.phonefactor.net </br>enterpriseregistration.windows.net</br>management.azure.com </br>policykeyservice.dc.ad.msft.net</br>ctdl.windowsupdate.us:80| The agent uses these URLs during the registration process.
42+
43+
### Install the agent for the Azure Government cloud
44+
45+
Follow these steps to install the agent for the Azure Government cloud:
46+
47+
1. In the command line terminal, navigate to the folder that contains the executable that installs the agent.
48+
1. Run the following commands, which specify that the installation is for Azure Government.
49+
50+
For Azure AD Pass-through Authentication:
51+
52+
```
53+
AADConnectAuthAgentSetup.exe ENVIRONMENTNAME="AzureUSGovernment"
54+
```
55+
56+
For Azure AD Application Proxy:
57+
58+
```
59+
AADApplicationProxyConnectorInstaller.exe ENVIRONMENTNAME="AzureUSGovernment"
60+
```
61+
62+
## Single sign-on (SSO)
63+
64+
### Set up your Azure AD Connect server
65+
66+
If you use Pass-through Authentication as your sign-on method, no additional prerequisite check is required. If you use password hash synchronization as your sign-on method and there is a firewall between Azure AD Connect and Azure AD, ensure that:
67+
68+
- You use Azure AD Connect version 1.1.644.0 or later.
69+
- If your firewall or proxy allows DNS whitelisting, add the connections to the *.msappproxy.us URLs over port 443.</br>If not, allow access to the Azure datacenter IP ranges, which are updated weekly. This prerequisite applies only when you enable the feature. It is not required for actual user sign-ons.
70+
71+
### Roll out Seamless SSO
72+
73+
You can gradually roll out Azure AD Seamless Single Sign-On (Seamless SSO) to your users by using the following instructions. You start by adding the Azure AD URL [https://autologon.microsoft.us](https://autologon.microsoft.us) to all or selected users' Intranet zone settings by using Group Policy in Active Directory.
74+
75+
You also need to enable the Intranet zone policy setting **Allow updates to status bar via script through Group Policy**.
76+
77+
## Browser considerations
78+
79+
### Mozilla Firefox (all platforms)
80+
81+
Mozilla Firefox doesn't automatically use Kerberos authentication. Each user must manually add the Azure AD URL to their Firefox settings by following these steps:
82+
83+
1. Run Firefox and enter **about:config** in the address bar. Dismiss any notifications that you might see.
84+
1. Search for the **network.negotiate-auth.trusted-uris** preference. </br>This preference lists the sites trusted by Firefox for Kerberos authentication.
85+
1. Right-click and then select **Modify**.
86+
1. Enter https://autologon.microsoft.us in the box.
87+
1. Select **OK** and then reopen the browser.
88+
89+
### Microsoft Edge based on Chromium (all platforms)
90+
91+
If you have overridden the `AuthNegotiateDelegateAllowlist` or `AuthServerAllowlist` policy settings in your environment, ensure that you add the Azure AD URL [https://autologon.microsoft.us](https://autologon.microsoft.us) to them.
92+
93+
### Google Chrome (all platforms)
94+
95+
If you have overridden the `AuthNegotiateDelegateWhitelist` or `AuthServerWhitelist` policy settings in your environment, ensure that you add the Azure AD URL [https://autologon.microsoft.us](https://autologon.microsoft.us) to them.
7796

7897
## Next steps
98+
7999
[Pass-through Authentication](how-to-connect-pta-quick-start.md#step-1-check-the-prerequisites)
80-
[Single Sign-on](how-to-connect-sso-quick-start.md#step-1-check-the-prerequisites)
100+
[Single Sign-on](how-to-connect-sso-quick-start.md#step-1-check-the-prerequisites)

0 commit comments

Comments
 (0)