Seamless Single Sign-on
When the optional Enable single sign-on setting is enabled in Azure AD Connect, next to PHS or PTA, it instructs Azure AD Connect to use Kerberos authentication using a specific computer object in the local Active Directory for this feature: AzureADSSOACC. This account is located in the default Computers container. The object creates two Service Principal Names (SPNs) defining the Azure Active Directory URLs. The credentials of the account are then shared by Azure AD Connect with Azure AD as the shared Kerberos secret to encrypt the interchanged Kerberos packets.
Using the SSO authentication method, persons authenticating to Azure AD on domain-joined devices talk Kerberos to Azure AD's authentication service, just ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access