We know that security is very important for IT administrators. In this article, you can find which ADConnect sync tool configuration is the best. I am going to explain what Azure AD Pass-through and Seamless Single Sign-On (SSO) does.
Normally, when you configure ADConnect with “Azure AD Password Hash Synchronization” feature, one copy of on-premise AD users’ passwords (hash values) always send to internet and store in cloud. Beyond this, authentication also happens in cloud.
Azure AD Password Hash Synchronization Process
Some companies don’t permit organizations to send users’ password even in hashed form because of their security and compliance policies. Nowadays security rules are very strict because of GDPR. Azure AD Pass-through authentication allows you to keep passwords on-premise and validate users’ passwords directly against your on-premises AD. Normally, if you want to authenticate users through on-premise you had to install ADFS server to on-premise side. To configure ADFS server in high availability mode you need minimum 4 servers (2 ADFS & 2 Proxy) + OS license + hardware + operational effort to keep the system running. That is why Pass-through authentication, where we don’t use ADFS servers, is a better solution.
How does Pass-through authentication work?
In lay terms when a user tries to
sign-in Office 365 and Azure with on-premises AD password, Microsoft servers encrypt the passwords using a public key and then a user-name and encrypted password wait for validation. Pass-through agent retrieves the user name and encrypted password by making outbound call from your network. Pass-through agent uses https port to receive information. You don’t need to open inbound ports on your firewall.
The agent decrypts the password using a private key that only the agent has access to and tries to validate it against an on-premise active directory. The active directory returns “success” or “failure” result to the agent and the agent forwards it up to Azure AD.
As a result, Azure AD decides to sign-in the service or not.
How to configure Pass-through authentication on ADConnect?
When you run ADConnect setup you should select the sign-on method as “Pass-through authentication” on the interface.
In the second option you can also select “enable single sign-on”. What is the benefit of SSO (Single sign-on)? In fact when you enable SSO in ADConnect , if users’ computers are “domain joined” and already signed-in ad account on domain network, they don’t need to write passwords on sign-in page while they are signing in Azure and Office 365 services. The feature providing users with automatic sign-in Azure AD.
If you have enabled SSO on ADConnect, you need to add Azure AD URL to the users’ Intranet zone settings by using GPO in Active Directory.
1-Browse to User Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page. Then select “Site to Zone Assignment List”.
Enable the policy, and then enter the following values in the dialog box:
Value name: https://autologon.microsoftazuread-sso.com
Value (Data): 1 indicates the Intranet zone.
It should be as it shown below;
2- Browse to User Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Intranet Zone. Then select “Allow updates to status bar via script”.
Enable the policy settings as it shown below.
Notes:
-If you use firewall or proxy, you have to
allow *.msappproxy.net URLs over port 443 ,
-Enabling SSO services can take up to 30 minutes ,
– Edge browser support is not available.;
-If you disable or re-enable the feature, users will not be able to get single sign-on experience until their cached Kerberos tickets, which are generally valid for 10 hours, have expired.
–The feature is free, so you don’t need the paid edition of Azure AD.
To verify the feature:
Select Azure Active Directory in the left pane.
Select Azure AD Connect.
