adding include

Author: billmath

includes/active-directory-cloud-provisioning-sso.md

@@ -0,0 +1,52 @@
+---
+author: billmath
+ms.service: active-directory
+ms.subservice: cloud-provisioning
+ms.topic: include
+ms.date: 10/16/2019
+ms.author: billmath
+# Used by articles that require an SSO workaround.
+---
+
+## Steps to enable Single Sign-on
+Cloud provisioning works with Single Sign-on.  Currently their is not an option to enable SSO when the agent is installed, however you can use the steps below to enable SSO and use it. 
+
+### Step 1: Import the Seamless SSO PowerShell module
+
+1. First, download, and install [Azure AD PowerShell](https://docs.microsoft.com/powershell/azure/active-directory/overview).
+2. Browse to the `%programfiles%\Microsoft Azure Active Directory Connect` folder.
+3. Import the Seamless SSO PowerShell module by using this command: `Import-Module .\AzureADSSO.psd1`.
+
+### Step 2: Get the list of Active Directory forests on which Seamless SSO has been enabled
+
+1. Run PowerShell as an administrator. In PowerShell, call `New-AzureADSSOAuthenticationContext`. When prompted, enter your tenant's global administrator credentials.
+2. Call `Get-AzureADSSOStatus`. This command provides you with the list of Active Directory forests (look at the "Domains" list) on which this feature has been enabled.
+
+### Step 3: Disable Seamless SSO for each Active Directory forest where you've set up the feature
+
+1. Call `$creds = Get-Credential`. When prompted, enter the domain administrator credentials for the intended Active Directory forest.
+
+   > [!NOTE]
+   >The domain administrator credentials username must be entered in the SAM account name format  (contoso\johndoe or contoso.com\johndoe). We use the domain portion of the username to locate the Domain Controller of the Domain Administrator using DNS.
+
+   >[!NOTE]
+   >The domain administrator account used must not be a member of the Protected Users group. If so, the operation will fail.
+
+2. Call `Disable-AzureADSSOForest -OnPremCredentials $creds`. This command removes the `AZUREADSSOACC` computer account from the on-premises domain controller for this specific Active Directory forest.
+3. Repeat the preceding steps for each Active Directory forest where you’ve set up the feature.
+
+### Step 4: Enable Seamless SSO for each Active Directory forest
+
+1. Call `Enable-AzureADSSOForest`. When prompted, enter the domain administrator credentials for the intended Active Directory forest.
+
+   > [!NOTE]
+   >The domain administrator credentials username must be entered in the SAM account name format  (contoso\johndoe or contoso.com\johndoe). We use the domain portion of the username to locate the Domain Controller of the Domain Administrator using DNS.
+
+   >[!NOTE]
+   >The domain administrator account used must not be a member of the Protected Users group. If so, the operation will fail.
+
+2. Repeat the preceding step for each Active Directory forest where you want to set up the feature.
+
+### Step 5. Enable the feature on your tenant
+
+To turn on the feature on your tenant, call `Enable-AzureADSSO -Enable $true`.