|
| 1 | +--- |
| 2 | +title: 'Azure AD Connect: Hybrid Identity Considerations for Azure Government ' |
| 3 | +description: Special considerations for deploying Azure AD Connect with the government cloud. |
| 4 | +services: active-directory |
| 5 | +author: billmath |
| 6 | +manager: daveba |
| 7 | +ms.service: active-directory |
| 8 | +ms.workload: identity |
| 9 | +ms.topic: article |
| 10 | +ms.date: 03/16/2020 |
| 11 | +ms.subservice: hybrid |
| 12 | +ms.author: billmath |
| 13 | +ms.collection: M365-identity-device-management |
| 14 | +--- |
| 15 | + |
| 16 | +# Hybrid Identity Considerations for Azure Government |
| 17 | + |
| 18 | +> [!NOTE] |
| 19 | +> Upgrade to the latest release of [Azure AD Connect](https://www.microsoft.com/download/details.aspx?id=47594). |
| 20 | +
|
| 21 | +> [!NOTE] |
| 22 | +> For a full list of U.S. Government DoD Endpoints, refer to the [documentation](https://docs.microsoft.com/office365/enterprise/office-365-u-s-government-dod-endpoints) |
| 23 | +
|
| 24 | +## Pass Through Authentication |
| 25 | + |
| 26 | +### Allow access to URLs |
| 27 | +Before deploying the pass-through authentication agent, verify if there is a firewall between your servers and Azure AD, and if so, configure the following items: |
| 28 | + |
| 29 | +- If your firewall or proxy allows DNS whitelisting, whitelist connections to *.msapproxy.us and *.servicebus.usgovcloudapi.net. If not, allow access to the Azure datacenter IP ranges, which are updated weekly. |
| 30 | +- Your Authentication Agents need access to login.windows.us and login.microsoftonline.us for initial registration. Open your firewall for those URLs as well. |
| 31 | +- For certificate validation, unblock the following URLs: mscrl.microsoft.us:80, crl.microsoft.us:80, ocsp.msocsp.us:80, and www.microsoft.us:80. Since these URLs are used for certificate validation with other Microsoft products you may already have these URLs unblocked. |
| 32 | + |
| 33 | +Before deploying the pass-through authentication agent, verify if there is a firewall between your servers and Azure AD. If your firewall or proxy allows DNS whitelisting, whitelist the following connections: |
| 34 | + |
| 35 | + |
| 36 | +|URL |How it's used| |
| 37 | +|-----|-----| |
| 38 | +|*.msappproxy.us *.servicebus.usgovcloudapi.net|Communication between the agent and the Azure AD cloud service | |
| 39 | +|mscrl.microsoft.us:80 crl.microsoft.us:80 </br>ocsp.msocsp.us:80 www.microsoft.us:80| The agent uses these URLs to verify certificates.| |
| 40 | +|login.windows.us secure.aadcdn.microsoftonline-p.com *.microsoftonline.us </br>*.microsoftonline-p.us </br>*.msauth.net </br>*.msauthimages.net </br>*.msecnd.net</br>*.msftauth.net </br>*.msftauthimages.net</br>*.phonefactor.net </br>enterpriseregistration.windows.net</br>management.azure.com </br>policykeyservice.dc.ad.msft.net</br>ctdl.windowsupdate.us:80| The agent uses these URLs during the registration process.| |
| 41 | + |
| 42 | +### Install the agent for the Azure Government cloud |
| 43 | +In order to install the agent for the Azure Government cloud you must follow these specific steps: |
| 44 | +In the command line terminal, navigate to folder where the executable for installing the agent is located. |
| 45 | +Run the following command which specifies the installation is for Azure Government. |
| 46 | +For Passthrough Authentication: |
| 47 | +``` |
| 48 | +AADConnectAuthAgentSetup.exe REGISTERCONNECTOR="false" ENVIRONMENTNAME="AzureUSGovernment" /q |
| 49 | +For Application Proxy: |
| 50 | +AADApplicationProxyConnectorInstaller.exe ENVIRONMENTNAME="Azure |
| 51 | +USGovernment" |
| 52 | +``` |
| 53 | +## Single Sign On |
| 54 | +Set up your Azure AD Connect server: If you use Pass-through Authentication as your sign-in method, no additional prerequisite check is required. If you use password hash synchronization as your sign-in method, and if there is a firewall between Azure AD Connect and Azure AD, ensure that: |
| 55 | +- You use version 1.1.644.0 or later of Azure AD Connect. |
| 56 | +- If your firewall or proxy allows DNS whitelisting, whitelist the connections to the *.msapproxy.us URLs over port 443. If not, allow access to the Azure datacenter IP ranges, which are updated weekly. This prerequisite is applicable only when you enable the feature. It is not required for actual user sign-ins. |
| 57 | + |
| 58 | +### Rolling Out Seamless SSO |
| 59 | +You can gradually roll out Seamless SSO to your users using the instructions provided below. You start by adding the following Azure AD URL to all or selected users' Intranet zone settings by using Group Policy in Active Directory: |
| 60 | +https://autologon.microsoft.us |
| 61 | + |
| 62 | +In addition, you need to enable an Intranet zone policy setting called Allow updates to status bar via script through Group Policy. |
| 63 | +Browser considerations |
| 64 | +Mozilla Firefox (all platforms) |
| 65 | +Mozilla Firefox doesn't automatically use Kerberos authentication. Each user must manually add the Azure AD URL to their Firefox settings by using the following steps: |
| 66 | +1. Run Firefox and enter about:config in the address bar. Dismiss any notifications that you see. |
| 67 | +2. Search for the network.negotiate-auth.trusted-uris preference. This preference lists Firefox's trusted sites for Kerberos authentication. |
| 68 | +3. Right-click and select Modify. |
| 69 | +4. Enter https://autologon.microsoft.us in the field. |
| 70 | +5. Select OK and then reopen the browser. |
| 71 | + |
| 72 | +### Microsoft Edge based on Chromium (all platforms) |
| 73 | +If you have overridden the `AuthNegotiateDelegateAllowlist` or the `AuthServerAllowlist` policy settings in your environment, ensure that you add Azure AD's URL (https://autologon.microsoft.us) to them as well. |
| 74 | + |
| 75 | +### Google Chrome (all platforms) |
| 76 | +If you have overridden the `AuthNegotiateDelegateWhitelist` or the `AuthServerWhitelist` policy settings in your environment, ensure that you add Azure AD's URL (https://autologon.microsoft.us) to them as well. |
| 77 | + |
| 78 | +## Next Steps |
| 79 | +[Pass-through Authentication](how-to-connect-pta-quick-start.md#step-1-check-the-prerequisites) |
| 80 | +[Single Sign-on](how-to-connect-sso-quick-start,md#step-1-check-the-prerequisites) |
0 commit comments