With Azure AD Connect, you can synchronize on-premises Active Directory objects to Office 365 and Azure AD. Therefore users can use their on-premises credentials to authenticate against Office 365 and Azure.

If you also want to support single sign-on to those users, so that they don’t need to enter their credentials each time when accessing resources in Office 365 or Azure, you can achieve this with three different options.

  • Seamless SSO (Password Hash Synchronization or Pass-through Authentication)
  • Primary Refresh Token (PRT)
  • AD FS Federation


!!! NOTE !!!
As Seamless SSO is only used for Windows 7 and 8.1 domain-joined devices, I will set the focus on the Primary Refresh Token (PRT) for Windows 10 devices.

Windows 10 devices, either Azure AD joined, Hybrid Azure AD joined or Azure AD registered, works based on the Primary Refresh Token (PRT)


Table Of Contents
  1. What is Azure Active Directory Seamless Single Sign-On (SSO)?
  2. SSO via Primary Refresh Token vs. Seamless SSO
  3. Differences between the single sign-on experience for PRT and Seamless SSO?
  4. Enable Seamless Single Sign-On
  5. What is a Primary Refresh Token?
  6. OAuth 2.0 and OpenID Connect – Tokens
  7. Links



What is Azure Active Directory Seamless Single Sign-On (SSO)?

As already mentioned, Seamless SSO is only used for Windows 7 and 8.1 domain-joined devices.

Azure Active Directory Seamless Single Sign-On (Azure AD Seamless SSO) automatically signs users in when they are on their corporate devices connected to your corporate network. When enabled, users don’t need to type in their passwords to sign in to Azure AD, and usually, even type in their usernames. This feature provides your users easy access to your cloud-based applications without needing any additional on-premises components.

Seamless SSO can be combined with either the Password Hash Synchronization or Pass-through Authentication sign-in methods. Seamless SSO is not applicable to Active Directory Federation Services (ADFS).

Source: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso





SSO via Primary Refresh Token vs. Seamless SSO

For Windows 10, Windows Server 2016 and later versions, it’s recommended to use SSO via primary refresh token (PRT).

For Windows 7 and 8.1 it’s recommended to use Seamless SSO. Seamless SSO needs the user’s device to be domain-joined, but it is not used on Windows 10 Azure AD joined devices or hybrid Azure AD joined devices. SSO on Azure AD joined, Hybrid Azure AD joined, and Azure AD registered devices works based on the Primary Refresh Token (PRT)

SSO via PRT works once devices are registered with Azure AD for hybrid Azure AD joined, Azure AD joined or personal registered devices via Add Work or School Account. For more information on how SSO works with Windows 10 using PRT, see: Primary Refresh Token (PRT) and Azure AD

Source: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso#sso-via-primary-refresh-token-vs-seamless-sso


Seamless Single Sign-On: Technical deep dive
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-how-it-works#how-does-seamless-sso-work





Differences between the single sign-on experience for PRT and Seamless SSO?

Azure AD Join, Hybrid Azure AD join and Azure AD registered provides SSO to users if their devices are registered with Azure AD. These devices don’t necessarily have to be domain-joined. SSO is provided using primary refresh tokens or PRTs, and not Kerberos. The user experience is most optimal on Windows 10 devices. SSO happens automatically on the Microsoft Edge browser. It also works on Chrome with the use of a browser extension.

You can use both registered with Azure AD and Seamless SSO on your tenant. These two features are complementary. If both features are turned on, then SSO via PRT takes precedence over Seamless SSO.

Source: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-faq
Here Microsoft only speaks about Azure AD join, but it is also true for Hybrid Azure AD join and Azure AD registered or generally for devices registered with Azure AD. Therefore the text above is adjusted on my part.





Enable Seamless Single Sign-On

Azure Active Directory Seamless Single Sign-On: Quickstart
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-quick-star


Enable Seamless SSO through Azure AD Connect.

The option will be available for selection only if the Sign On method is Password Hash Synchronization or Pass-through Authentication.


You can verify if you have enabled Seamless SSO correctly through the Azure Portal under Azure Active Directory -> Azure AD Connect -> USER SIGN-IN

Seamless SSO creates a computer account named AZUREADSSOACC in your on-premises Active Directory (AD) in each AD forest. The AZUREADSSOACC computer account needs to be strongly protected for security reasons. Only Domain Admins should be able to manage the computer account. Ensure that Kerberos delegation on the computer account is disabled, and that no other account in Active Directory has delegation permissions on the AZUREADSSOACC computer account. Store the computer account in an Organization Unit (OU) where they are safe from accidental deletions and where only Domain Admins have access.


Add the following Trusted Sites as Intranet Zone
autologon.microsoftazuread-sso.com
aadg.windows.net.nsatc.net

In addition, you need to enable an Intranet zone policy setting called Allow updates to status bar via script through Group Policy.

Source: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-quick-start#group-policy-option—detailed-steps





What is a Primary Refresh Token?

In a nutshell, the Primary Refresh Token (PRT) is a special high privileged refresh token where you can request access tokens for any registered application in Azure and Microsoft 365 to authenticate against it. Compared to Active Directory in on-premises networks, it is the equivalence to the Ticket Granting Ticket (TGT).

More about Primary Refresh Token (PRT) you will find in my following post.

Primary Refresh Token (PRT) in Azure and Microsoft 365





OAuth 2.0 and OpenID Connect – Tokens

Microsoft identity platform ID tokens
https://docs.microsoft.com/en-us/azure/active-directory/develop/id-tokens

Microsoft identity platform access tokens
https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens

Microsoft identity platform refresh tokens
https://docs.microsoft.com/en-us/azure/active-directory/develop/refresh-tokens



More about OAuth 2.0 and OpenID Connect you will also find in my following post.

How OAuth 2.0 and OpenID Connect works





Links

Azure Active Directory Seamless Single Sign-On
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso

How does Seamless SSO work?
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-how-it-works#how-does-seamless-sso-work

Azure Active Directory Seamless Single Sign-On: Quickstart
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-quick-start

What is a Primary Refresh Token?
https://docs.microsoft.com/en-us/azure/active-directory/devices/concept-primary-refresh-token