You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -23,7 +23,7 @@ This article defines authentication and authorization and briefly covers how you
23
23
24
24
## Authentication
25
25
26
-
**Authentication** is the process of proving you are who you say you are. Authentication is sometimes shortened to AuthN. Microsoft identity platform implements the [OpenID Connect](https://openid.net/connect/)and [SAML 2.0](http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html) protocols for handling authentication.
26
+
**Authentication** is the process of proving you are who you say you are. Authentication is sometimes shortened to AuthN. Microsoft identity platform implements the [OpenID Connect](https://openid.net/connect/)protocol for handling authentication.
27
27
28
28
## Authorization
29
29
@@ -35,13 +35,13 @@ Instead of creating apps that each maintain their own username and password info
35
35
36
36
Azure Active Directory (Azure AD) is a centralized identity provider in the cloud. Delegating authentication and authorization to it enables scenarios such as Conditional Access policies that require a user to be in a specific location, the use of multi-factor authentication, as well as enabling a user to sign in once and then be automatically signed in to all of the web apps that share the same centralized directory. This capability is referred to as **Single Sign On (SSO)**.
37
37
38
-
Microsoft identity platform simplifies authentication and authorization for application developers by providing identity as a service, with support for industry-standard protocols such as OAuth 2.0, OpenID Connect, and SAML 2.0, as well as open-source libraries for different platforms to help you start coding quickly. It allows developers to build applications that sign in all Microsoft identities, get tokens to call [Microsoft Graph](https://developer.microsoft.com/graph/), other Microsoft APIs, or APIs that developers have built. For more information, see [Evolution of Microsoft identity platform](about-microsoft-identity-platform.md).
38
+
Microsoft identity platform simplifies authentication and authorization for application developers by providing identity as a service, with support for industry-standard protocols such as OAuth 2.0and OpenID Connect, as well as open-source libraries for different platforms to help you start coding quickly. It allows developers to build applications that sign in all Microsoft identities, get tokens to call [Microsoft Graph](https://developer.microsoft.com/graph/), other Microsoft APIs, or APIs that developers have built. For more information, see [Evolution of Microsoft identity platform](about-microsoft-identity-platform.md).
39
39
40
40
Following is a brief comparison of the various protocols used by Microsoft identity platform:
41
41
42
42
***OAuth vs. OpenID Connect**: OAuth is used for authorization and OpenID Connect (OIDC) is used for authentication. OpenID Connect is built on top of OAuth 2.0, so the terminology and flow are similar between the two. You can even both authenticate a user (using OpenID Connect) and get authorization to access a protected resource that the user owns (using OAuth 2.0) in one request. For more information, see [OAuth 2.0 and OpenID Connect protocols](active-directory-v2-protocols.md) and [OpenID Connect protocol](v2-protocols-oidc.md).
43
43
***OAuth vs. SAML**: OAuth is used for authorization and SAML is used for authentication. See [Microsoft identity platform and OAuth 2.0 SAML bearer assertion flow](v2-saml-bearer-assertion.md) for more information on how the two protocols can be used together to both authenticate a user (using SAML) and get authorization to access a protected resource (using OAuth 2.0).
44
-
***OpenID Connect vs. SAML**: Both OpenID Connect and SAML are used to authenticate a user and are used to enable Single Sign On. SAML authentication is commonly used with identity providers such as Active Directory Federation Services (ADFS) federated to Azure AD and is therefore frequently used in enterprise applications.
44
+
***OpenID Connect vs. SAML**: Both OpenID Connect and SAML are used to authenticate a user and are used to enable Single Sign On. SAML authentication is commonly used with identity providers such as Active Directory Federation Services (ADFS) federated to Azure AD and is therefore frequently used in enterprise applications. OpenID Connect is commonly used for apps that are purely in the cloud, such as mobile apps, web sites, and web APIs.
@@ -24,6 +24,9 @@ If you’re just getting started, check out the [Microsoft identity platform doc
24
24
25
25
Use the following checklist to ensure that your application is effectively integrated with the [Microsoft identity platform](https://docs.microsoft.com/azure/active-directory/develop/).
26
26
27
+
> [!TIP]
28
+
> The *Integration assistant* in the Azure portal can help you apply many of these best practices and recommendations. Select any of your [app registrations](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade) in the Azure portal, and then select the **Integration assistant (preview)** menu item to get started with the assistant.
@@ -28,7 +28,7 @@ Access tokens are only valid for a short period of time, so authorization server
28
28
**ID tokens** are sent to the client application as part of an [OpenID Connect](v2-protocols-oidc.md) flow. They can be sent along side or instead of an access token, and are used by the client to authenticate the user. To learn more about how Microsoft identity platform issues ID tokens, see [ID tokens](id-tokens.md).
29
29
30
30
> [!NOTE]
31
-
> This article discusses security tokens for the OAuth2 and OpenID Connect protocols. Many enterprise applications use SAML to authenticate users. See [Azure AD SAML token reference](reference-saml-tokens.md) for information on SAML assertions.
31
+
> This article discusses security tokens used by the OAuth2 and OpenID Connect protocols. Many enterprise applications use SAML to authenticate users. See [Azure AD SAML token reference](reference-saml-tokens.md) for information on SAML assertions.
32
32
33
33
## Validating security tokens
34
34
@@ -43,7 +43,7 @@ Access tokens are passed to a web API as the bearer token in the `Authorization`
43
43
44
44
## JSON Web Tokens (JWTs) and claims
45
45
46
-
Microsoft identity platform implements security tokens as **JSON Web Tokens (JWTs)** that contain **claims**.
46
+
Microsoft identity platform implements security tokens as **JSON Web Tokens (JWTs)** that contain **claims**. Since JWTs are used as security tokens, this form of authentication is sometimes called **JWT authentication**.
47
47
48
48
A [claim](developer-glossary.md#claim) provides assertions about one entity, such as a client application or [resource owner](developer-glossary.md#resource-owner), to another entity, such as a resource server. A claim may also be referred to as a JWT claim or JSON Web Token claim.
title: 'Azure AD Connect: Hybrid identity considerations for Azure Government'
3
-
description: Special considerations for deploying Azure AD Connect with the government cloud.
2
+
title: 'Azure AD Connect: Hybrid identity considerations for Azure Government cloud'
3
+
description: Special considerations for deploying Azure AD Connect with the Azure Government cloud.
4
4
services: active-directory
5
5
author: billmath
6
6
manager: daveba
@@ -13,68 +13,89 @@ ms.author: billmath
13
13
ms.collection: M365-identity-device-management
14
14
---
15
15
16
-
# Hybrid identity considerations for Azure Government
17
-
The following document describes the considerations for implementing a hybrid environment with the Azure Government cloud. This information is provided as reference for administrators and architects who are working with the Azure Government cloud.
18
-
> [!NOTE]
19
-
> In order to integrate an on-premises AD environment with the Azure Governemnt cloud, you need to upgrade to the latest release of [Azure AD Connect](https://www.microsoft.com/download/details.aspx?id=47594).
16
+
# Hybrid identity considerations for the Azure Government cloud
20
17
21
-
> [!NOTE]
22
-
> For a full list of U.S. Government DoD Endpoints, refer to the [documentation](https://docs.microsoft.com/office365/enterprise/office-365-u-s-government-dod-endpoints)
18
+
This article describes considerations for integrating a hybrid environment with the Microsoft Azure Government cloud. This information is provided as a reference for administrators and architects who work with the Azure Government cloud.
23
19
24
-
## Pass-Through Authentication
25
-
The following information is provided for implementation of pass-through authentication (PTA) and the Azure Government cloud.
20
+
> [!NOTE]
21
+
> To integrate an on-premises Microsoft Azure Active Directory (Azure AD) environment with the Azure Government cloud, you need to upgrade to the latest release of [Azure AD Connect](https://www.microsoft.com/download/details.aspx?id=47594).
22
+
23
+
For a full list of United States government Department of Defense endpoints, refer to the [documentation](https://docs.microsoft.com/office365/enterprise/office-365-u-s-government-dod-endpoints).
24
+
25
+
## Azure AD Pass-through Authentication
26
+
27
+
The following information describes implementation of Pass-through Authentication and the Azure Government cloud.
28
+
29
+
### Allow access to URLs
30
+
31
+
Before you deploy the Pass-through Authentication agent, verify whether a firewall exists between your servers and Azure AD. If your firewall or proxy allows Domain Name System (DNS) blocked or safe programs, add the following connections.
26
32
27
-
### Allow access to URLs
28
-
Before deploying the pass-through authentication agent, verify if there is a firewall between your servers and Azure AD. If your firewall or proxy allows DNS whitelisting, add the following connections:
29
33
> [!NOTE]
30
-
> The following guidance also applies to installing the [Application Proxy connector](https://aka.ms/whyappproxy) for Azure Government environments.
34
+
> The following guidance also applies to installing the [Azure AD Application Proxy connector](https://aka.ms/whyappproxy) for Azure Government environments.
31
35
32
36
|URL |How it's used|
33
-
|-----|-----|
34
-
|*.msappproxy.us *.servicebus.usgovcloudapi.net|Communication between the agent and the Azure AD cloud service |
35
-
|mscrl.microsoft.us:80 crl.microsoft.us:80 </br>ocsp.msocsp.us:80 www.microsoft.us:80| The agent uses these URLs to verify certificates.|
36
-
|login.windows.us secure.aadcdn.microsoftonline-p.com *.microsoftonline.us </br>*.microsoftonline-p.us </br>*.msauth.net </br>*.msauthimages.net </br>*.msecnd.net</br>*.msftauth.net </br>*.msftauthimages.net</br>*.phonefactor.net </br>enterpriseregistration.windows.net</br>management.azure.com </br>policykeyservice.dc.ad.msft.net</br>ctdl.windowsupdate.us:80| The agent uses these URLs during the registration process.|
37
-
38
-
### Install the agent for the Azure Government cloud
39
-
In order to install the agent for the Azure Government cloud, you must follow these specific steps:
40
-
In the command line terminal, navigate to folder where the executable for installing the agent is located.
41
-
Run the following command which specifies the installation is for Azure Government.
Set up your Azure AD Connect server: If you use Pass-through Authentication as your sign-in method, no additional prerequisite check is required. If you use password hash synchronization as your sign-in method, and if there is a firewall between Azure AD Connect and Azure AD, ensure that:
55
-
- You use version 1.1.644.0 or later of Azure AD Connect.
56
-
- If your firewall or proxy allows DNS whitelisting, add the connections to the *.msapproxy.us URLs over port 443. If not, allow access to the Azure datacenter IP ranges, which are updated weekly. This prerequisite is applicable only when you enable the feature. It is not required for actual user sign-ins.
57
-
58
-
### Rolling out seamless SSO
59
-
You can gradually roll out Seamless SSO to your users using the instructions provided below. You start by adding the following Azure AD URL to all or selected users' Intranet zone settings by using Group Policy in Active Directory:
60
-
https://autologon.microsoft.us
61
-
62
-
In addition, you need to enable an Intranet zone policy setting called Allow updates to status bar via script through Group Policy.
63
-
Browser considerations
64
-
Mozilla Firefox (all platforms)
65
-
Mozilla Firefox doesn't automatically use Kerberos authentication. Each user must manually add the Azure AD URL to their Firefox settings by using the following steps:
66
-
1. Run Firefox and enter about:config in the address bar. Dismiss any notifications that you see.
67
-
2. Search for the network.negotiate-auth.trusted-uris preference. This preference lists Firefox's trusted sites for Kerberos authentication.
68
-
3. Right-click and select Modify.
69
-
4. Enter https://autologon.microsoft.us in the field.
70
-
5. Select OK and then reopen the browser.
71
-
72
-
### Microsoft Edge based on Chromium (all platforms)
73
-
If you have overridden the `AuthNegotiateDelegateAllowlist` or the `AuthServerAllowlist` policy settings in your environment, ensure that you add Azure AD's URL (https://autologon.microsoft.us) to them as well.
74
-
75
-
### Google Chrome (all platforms)
76
-
If you have overridden the `AuthNegotiateDelegateWhitelist` or the `AuthServerWhitelist` policy settings in your environment, ensure that you add Azure AD's URL (https://autologon.microsoft.us) to them as well.
37
+
|-----|-----|
38
+
|*.msappproxy.us</br>*.servicebus.usgovcloudapi.net|The agent uses these URLs to communicate with the Azure AD cloud service. |
39
+
|mscrl.microsoft.us:80 </br>crl.microsoft.us:80 </br>ocsp.msocsp.us:80 </br>www.microsoft.us:80| The agent uses these URLs to verify certificates.|
40
+
|login.windows.us </br>secure.aadcdn.microsoftonline-p.com </br>*.microsoftonline.us </br>*.microsoftonline-p.us </br>*.msauth.net </br>*.msauthimages.net </br>*.msecnd.net</br>*.msftauth.net </br>*.msftauthimages.net</br>*.phonefactor.net </br>enterpriseregistration.windows.net</br>management.azure.com </br>policykeyservice.dc.ad.msft.net</br>ctdl.windowsupdate.us:80| The agent uses these URLs during the registration process.
41
+
42
+
### Install the agent for the Azure Government cloud
43
+
44
+
Follow these steps to install the agent for the Azure Government cloud:
45
+
46
+
1. In the command-line terminal, go to the folder that contains the executable file that installs the agent.
47
+
1. Run the following commands, which specify that the installation is for Azure Government.
If you use Pass-through Authentication as your sign-on method, no additional prerequisite check is required. If you use password hash synchronization as your sign-on method and there is a firewall between Azure AD Connect and Azure AD, ensure that:
66
+
67
+
- You use Azure AD Connect version 1.1.644.0 or later.
68
+
- If your firewall or proxy allows DNS blocked or safe programs, add the connections to the *.msappproxy.us URLs over port 443.
69
+
70
+
If not, allow access to the Azure datacenter IP ranges, which are updated weekly. This prerequisite applies only when you enable the feature. It isn't required for actual user sign-ons.
71
+
72
+
### Roll out Seamless Single Sign-On
73
+
74
+
You can gradually roll out Azure AD Seamless Single Sign-On to your users by using the following instructions. You start by adding the Azure AD URL [https://autologon.microsoft.us](https://autologon.microsoft.us) to all or selected users' Intranet zone settings by using Group Policy in Active Directory.
75
+
76
+
You also need to enable the intranet zone policy setting **Allow updates to status bar via script through Group Policy**.
77
+
78
+
## Browser considerations
79
+
80
+
### Mozilla Firefox (all platforms)
81
+
82
+
Mozilla Firefox doesn't automatically use Kerberos authentication. Each user must manually add the Azure AD URL to their Firefox settings by following these steps:
83
+
84
+
1. Run Firefox and enter **about:config** in the address bar. Dismiss any notifications that you might see.
85
+
1. Search for the **network.negotiate-auth.trusted-uris** preference. This preference lists the sites trusted by Firefox for Kerberos authentication.
86
+
1. Right-click the preference name and then select **Modify**.
87
+
1. Enter [**https://autologon.microsoft.us**](https://autologon.microsoft.us**) in the box.
88
+
1. Select **OK** and then reopen the browser.
89
+
90
+
### Microsoft Edge based on Chromium (all platforms)
91
+
92
+
If you have overridden the `AuthNegotiateDelegateAllowlist` or `AuthServerAllowlist` policy settings in your environment, ensure that you add the Azure AD URL [https://autologon.microsoft.us](https://autologon.microsoft.us) to them.
93
+
94
+
### Google Chrome (all platforms)
95
+
96
+
If you have overridden the `AuthNegotiateDelegateWhitelist` or `AuthServerWhitelist` policy settings in your environment, ensure that you add the Azure AD URL [https://autologon.microsoft.us](https://autologon.microsoft.us) to them.
0 commit comments