adding include

Author: billmath

articles/active-directory/cloud-provisioning/TOC.yml

@@ -42,6 +42,8 @@
       href: how-to-install.md
     - name: Cloud provisioning configuration
       href: how-to-configure.md
+    - name: Use Single Sign-On
+      href: how-to-sso.md
   - name: Plan and design
     items:
     - name: Topologies and scenarios for Azure AD Connect cloud provisioning

articles/active-directory/cloud-provisioning/how-to-sso.md

@@ -0,0 +1,28 @@
+---
+title: 'How to use Single Sign-on with cloud provisioning'
+description: This article describes how to install and use sso with cloud provisioning.
+services: active-directory
+author: billmath
+manager: daveba
+ms.service: active-directory
+ms.workload: identity
+ms.topic: conceptual
+ms.date: 01/28/2020
+ms.subservice: hybrid
+ms.author: billmath
+ms.collection: M365-identity-device-management
+---
+
+# Using Single Sign-On with cloud provisioning
+The following document describes how to use single sign-on with cloud provisioning.
+
+[!INCLUDE [active-directory-cloud-provisioning-sso.md](../../../includes/active-directory-cloud-provisioning-sso.md)]
+
+
+
+
+
+## Next steps 
+
+- [What is provisioning?](what-is-provisioning.md)
+- [What is Azure AD Connect cloud provisioning?](what-is-cloud-provisioning.md)

includes/active-directory-cloud-provisioning-sso.md

@@ -11,30 +11,23 @@ ms.author: billmath
 ## Steps to enable Single Sign-on
 Cloud provisioning works with Single Sign-on.  Currently their is not an option to enable SSO when the agent is installed, however you can use the steps below to enable SSO and use it. 
 
-### Step 1: Import the Seamless SSO PowerShell module
+### Step 1: Download and extract Azure AD Connect files
+1.  First, download the latest version of [Azure AD Connect](https://www.microsoft.com/download/details.aspx?id=47594)
+2.  Open a command prompt using Administrative priviledges and navigate to the msi you just downloaded.
+3.  Run the following:  `msiexec /a C:\filepath\AzureADConnect.msi /qb TARGETDIR=C:\filepath\extractfolder`
+4. Change filepath and extractfolder to match your file path and the name of your extraction folder.  The contents should now be in the extraction folder.
 
-1. First, download, and install [Azure AD PowerShell](https://docs.microsoft.com/powershell/azure/active-directory/overview).
+### Step 2: Import the Seamless SSO PowerShell module
+
+1. Download, and install [Azure AD PowerShell](https://docs.microsoft.com/powershell/azure/active-directory/overview).
 2. Browse to the `%programfiles%\Microsoft Azure Active Directory Connect` folder.
 3. Import the Seamless SSO PowerShell module by using this command: `Import-Module .\AzureADSSO.psd1`.
 
-### Step 2: Get the list of Active Directory forests on which Seamless SSO has been enabled
+### Step 3: Get the list of Active Directory forests on which Seamless SSO has been enabled
 
 1. Run PowerShell as an administrator. In PowerShell, call `New-AzureADSSOAuthenticationContext`. When prompted, enter your tenant's global administrator credentials.
 2. Call `Get-AzureADSSOStatus`. This command provides you with the list of Active Directory forests (look at the "Domains" list) on which this feature has been enabled.
 
-### Step 3: Disable Seamless SSO for each Active Directory forest where you've set up the feature
-
-1. Call `$creds = Get-Credential`. When prompted, enter the domain administrator credentials for the intended Active Directory forest.
-
-   > [!NOTE]
-   >The domain administrator credentials username must be entered in the SAM account name format  (contoso\johndoe or contoso.com\johndoe). We use the domain portion of the username to locate the Domain Controller of the Domain Administrator using DNS.
-
-   >[!NOTE]
-   >The domain administrator account used must not be a member of the Protected Users group. If so, the operation will fail.
-
-2. Call `Disable-AzureADSSOForest -OnPremCredentials $creds`. This command removes the `AZUREADSSOACC` computer account from the on-premises domain controller for this specific Active Directory forest.
-3. Repeat the preceding steps for each Active Directory forest where you’ve set up the feature.
-
 ### Step 4: Enable Seamless SSO for each Active Directory forest
 
 1. Call `Enable-AzureADSSOForest`. When prompted, enter the domain administrator credentials for the intended Active Directory forest.