Skip to content

Update how-to-connect-sso-faq.yml #1955

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ARL-DW wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Update how-to-connect-sso-faq.yml #1955

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d9f39ca
Update how-to-connect-sso-faq.yml
ARL-DW Apr 27, 2026
ddaffce
Update how-to-connect-sso-faq.yml
ARL-DW Apr 27, 2026
31f832e
Update how-to-connect-sso-faq.yml
ARL-DW Apr 27, 2026
a0ec8f8
Update how-to-connect-sso-faq.yml
ARL-DW Apr 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 23 additions & 23 deletions docs/identity/hybrid/connect/how-to-connect-sso-faq.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ sections:
Seamless SSO is available for the [Azure Government cloud](https://www.microsoft.com/de-de/microsoft-cloud). For details, view [Hybrid Identity Considerations for Azure Government](./reference-connect-government-cloud.md).

- question: |
What applications take advantage of `domain_hint` or `login_hint` parameter capability of Seamless SSO?
What applications take advantage of 'domain_hint' or 'login_hint' parameter capability of Seamless SSO?
Copy link

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use inline code formatting (backticks) for parameter names like domain_hint/login_hint; single quotes remove code styling and diverge from existing docs conventions (for example, how-to-connect-sso.md uses backticks for these parameters).

Suggested change
What applications take advantage of 'domain_hint' or 'login_hint' parameter capability of Seamless SSO?
What applications take advantage of `domain_hint` or `login_hint` parameter capability of Seamless SSO?

Copilot uses AI. Check for mistakes.
answer: |
The table has a list of applications that can send these parameters to Microsoft Entra ID. This action provides users a silent sign-on experience using Seamless SSO.:

Expand All @@ -59,9 +59,9 @@ sections:
If you want other applications using our silent sign-on experience, let us know in the feedback section.

- question: |
Does Seamless SSO support `Alternate ID` as the username, instead of `userPrincipalName`?
Does Seamless SSO support 'Alternate ID' as the username, instead of 'userPrincipalName'?
answer: |
Yes. Seamless SSO supports `Alternate ID` as the username when configured in Microsoft Entra Connect as shown [here](how-to-connect-install-custom.md). Not all Microsoft 365 applications support `Alternate ID`. Refer to the specific application's documentation for the support statement.
Yes. Seamless SSO supports 'Alternate ID' as the username when configured in Microsoft Entra Connect as shown [here](how-to-connect-install-custom.md). Not all Microsoft 365 applications support 'Alternate ID'. Refer to the specific application's documentation for the support statement.
Copy link

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use inline code formatting (backticks) for identifiers like Alternate ID and userPrincipalName. Replacing backticks with single quotes removes monospace formatting and makes these look like prose rather than attribute names.

Suggested change
Yes. Seamless SSO supports 'Alternate ID' as the username when configured in Microsoft Entra Connect as shown [here](how-to-connect-install-custom.md). Not all Microsoft 365 applications support 'Alternate ID'. Refer to the specific application's documentation for the support statement.
Yes. Seamless SSO supports `Alternate ID` as the username when configured in Microsoft Entra Connect as shown [here](how-to-connect-install-custom.md). Not all Microsoft 365 applications support `Alternate ID`. Refer to the specific application's documentation for the support statement.

Copilot uses AI. Check for mistakes.

- question: |
What is the difference between the single sign-on experience provided by Microsoft Entra join and Seamless SSO?
Expand All @@ -76,38 +76,38 @@ sections:
Yes, this scenario needs version 2.1 or later of the [workplace-join client](https://www.microsoft.com/download/details.aspx?id=53554).

- question: |
How can I roll over the Kerberos decryption key of the `AZUREADSSO` computer account?
How can I roll over the Kerberos decryption key of the 'AZUREADSSO' computer account?
answer: |
It's important to frequently roll over the Kerberos decryption key of the `AZUREADSSO` computer account (which represents Microsoft Entra ID) created in your on-premises AD forest.
It's important to frequently roll over the Kerberos decryption key of the 'AZUREADSSO' computer account (which represents Microsoft Entra ID) created in your on-premises AD forest.

>[!IMPORTANT]
>We highly recommend that you roll over the Kerberos decryption key at least every **30 days** using the `Update-AzureADSSOForest` cmdlet. When using the `Update-AzureADSSOForest` cmdlet, ensure that you *don't* run the `Update-AzureADSSOForest` command more than once per forest. Otherwise, the feature stops working until the time your users' Kerberos tickets expire and are reissued by your on-premises Active Directory.
>We highly recommend that you roll over the Kerberos decryption key at least every **30 days** using the 'Update-AzureADSSOForest' cmdlet. When using the 'Update-AzureADSSOForest' cmdlet, ensure that you *don't* run the 'Update-AzureADSSOForest' command more than once per forest. Otherwise, the feature stops working until the time your users' Kerberos tickets expire and are reissued by your on-premises Active Directory.
Comment on lines +79 to +84
Copy link

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use backticks for the computer account name (AZUREADSSO) and cmdlet name (Update-AzureADSSOForest). Single quotes drop the usual command/identifier styling and reduce scanability in a procedural FAQ.

Copilot uses AI. Check for mistakes.


Follow these steps on the on-premises server where you're running Microsoft Entra Connect:

> [!NOTE]
>You need domain administrator and Hybrid Identity Administrator credentials for the steps.
>If you're not a domain admin and you were assigned permissions by the domain admin, you should call `Update-AzureADSSOForest -OnPremCredentials $creds -PreserveCustomPermissionsOnDesktopSsoAccount`
>If you're not a domain admin and you were assigned permissions by the domain admin, you should call 'Update-AzureADSSOForest -OnPremCredentials $creds -PreserveCustomPermissionsOnDesktopSsoAccount'

**Step 1. Get list of AD forests where Seamless SSO is enabled**

1. Navigate to the `$env:programfiles"\Microsoft Azure Active Directory Connect"` folder.
2. Import the Seamless SSO PowerShell module using this command: `Import-Module .\AzureADSSO.psd1`.
3. Run PowerShell as an Administrator. In PowerShell, call `New-AzureADSSOAuthenticationContext`. This command should give you a popup to enter your tenant's Hybrid Identity Administrator credentials.
4. Call `Get-AzureADSSOStatus | ConvertFrom-Json`. This command provides a list of AD forests (look at the "Domains" list) on which this feature has been enabled.
1. Navigate to the '$env:programfiles"\Microsoft Azure Active Directory Connect"' folder.
2. Import the Seamless SSO PowerShell module using this command: 'Import-Module .\AzureADSSO.psd1'.
Comment on lines +95 to +96
Copy link

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The path shown as $env:programfiles"\Microsoft Azure Active Directory Connect" isn't valid PowerShell syntax. Consider showing it as a proper expandable string (for example, "$env:ProgramFiles\Microsoft Azure Active Directory Connect") or via Join-Path, and keep it in backticks for code formatting.

Suggested change
1. Navigate to the '$env:programfiles"\Microsoft Azure Active Directory Connect"' folder.
2. Import the Seamless SSO PowerShell module using this command: 'Import-Module .\AzureADSSO.psd1'.
1. Navigate to the `"$env:ProgramFiles\Microsoft Azure Active Directory Connect"` folder.
2. Import the Seamless SSO PowerShell module using this command: `Import-Module .\AzureADSSO.psd1`.

Copilot uses AI. Check for mistakes.
3. Run PowerShell as an Administrator. In PowerShell, call 'New-AzureADSSOAuthenticationContext'. This command should give you a popup to enter your tenant's Hybrid Identity Administrator credentials.
4. Call 'Get-AzureADSSOStatus | ConvertFrom-Json'. This command provides a list of AD forests (look at the "Domains" list) on which this feature has been enabled.

**Step 2. Update the Kerberos decryption key on each AD forest that it was set up on**

1. Call `$creds = Get-Credential`. When prompted, enter the Domain Administrator credentials for the intended AD forest.
1. Call '$creds = Get-Credential'. When prompted, enter the Domain Administrator credentials for the intended AD forest.
Copy link

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Commands like $creds = Get-Credential are currently wrapped in single quotes; these should be formatted as inline code (backticks) so they render as commands rather than quoted text.

Copilot uses AI. Check for mistakes.

> [!NOTE]
>The domain administrator credentials username must be entered in the SAM account name format (contoso\johndoe or contoso.com\johndoe). We use the domain portion of the username to locate the Domain Controller of the Domain Administrator using DNS.

>[!NOTE]
>The domain administrator account used must not be a member of the Protected Users group. If so, the operation fails.

2. Call `Update-AzureADSSOForest -OnPremCredentials $creds`. This command updates the Kerberos decryption key for the `AZUREADSSO` computer account in this specific AD forest and updates it in Microsoft Entra ID.
2. Call 'Update-AzureADSSOForest -OnPremCredentials $creds'. This command updates the Kerberos decryption key for the 'AZUREADSSO' computer account in this specific AD forest and updates it in Microsoft Entra ID.
Copy link

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The cmdlet call Update-AzureADSSOForest -OnPremCredentials $creds and the AZUREADSSO account name should be inline code (backticks). Using single quotes removes the standard command/identifier styling and makes the command harder to copy correctly.

Copilot uses AI. Check for mistakes.

3. Repeat the preceding steps for each AD forest that you’ve set up the feature on.

Expand Down Expand Up @@ -138,12 +138,12 @@ sections:

Run the following steps on the on-premises server where you're running Microsoft Entra Connect:

1. Navigate to the `$env:ProgramFiles"\Microsoft Azure Active Directory Connect"` folder.
2. Import the Seamless SSO PowerShell module using this command: `Import-Module .\AzureADSSO.psd1`.
3. Run PowerShell as an Administrator. In PowerShell, call `New-AzureADSSOAuthenticationContext`. This command should give you a popup to enter your tenant's Hybrid Identity Administrator credentials.
4. Call `Enable-AzureADSSO -Enable $false`.
1. Navigate to the '$env:ProgramFiles"\Microsoft Azure Active Directory Connect"' folder.
2. Import the Seamless SSO PowerShell module using this command: 'Import-Module .\AzureADSSO.psd1'.
3. Run PowerShell as an Administrator. In PowerShell, call 'New-AzureADSSOAuthenticationContext'. This command should give you a popup to enter your tenant's Hybrid Identity Administrator credentials.
Comment on lines +141 to +143
Copy link

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Option B steps show $env:ProgramFiles"\Microsoft Azure Active Directory Connect" which isn't valid PowerShell syntax as written. Prefer an expandable string (for example, "$env:ProgramFiles\Microsoft Azure Active Directory Connect") or Join-Path, and keep module/cmdlet invocations in backticks rather than single quotes.

Copilot uses AI. Check for mistakes.
4. Call 'Enable-AzureADSSO -Enable $false'.

At this point Seamless SSO is disabled but the domains remain configured in case you would like to enable Seamless SSO back. If you would like to remove the domains from Seamless SSO configuration completely, call the following cmdlet after you completed step 5 above: `Disable-AzureADSSOForest -DomainFqdn <fqdn>`.
At this point Seamless SSO is disabled but the domains remain configured in case you would like to enable Seamless SSO back. If you would like to remove the domains from Seamless SSO configuration completely, call the following cmdlet after you completed step 5 above: Disable-AzureADSSOForest -DomainFqdn "&lt;fqdn&gt;"
Copy link

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Disable-AzureADSSOForest example lost inline code formatting and now contains an HTML-escaped placeholder ("<fqdn>") which will render incorrectly and is harder to copy. Use backticks and a literal placeholder. Also, this sentence references "step 5" even though Option B has 4 steps here—please correct the step reference.

Suggested change
At this point Seamless SSO is disabled but the domains remain configured in case you would like to enable Seamless SSO back. If you would like to remove the domains from Seamless SSO configuration completely, call the following cmdlet after you completed step 5 above: Disable-AzureADSSOForest -DomainFqdn "&lt;fqdn&gt;"
At this point Seamless SSO is disabled but the domains remain configured in case you would like to enable Seamless SSO back. If you would like to remove the domains from Seamless SSO configuration completely, call the following cmdlet after you complete step 4 above: `Disable-AzureADSSOForest -DomainFqdn "<fqdn>"`

Copilot uses AI. Check for mistakes.

>[!IMPORTANT]
>Disabling Seamless SSO using PowerShell won't change the state in Microsoft Entra Connect. Seamless SSO shows as enabled in the **Change user sign-in** page.
Expand All @@ -155,12 +155,12 @@ sections:

Follow tasks 1 through 4 if you have disabled Seamless SSO using Microsoft Entra Connect. If you have disabled Seamless SSO using PowerShell instead, jump ahead to task 5.

1. Navigate to the `$env:ProgramFiles"\Microsoft Azure Active Directory Connect"` folder.
2. Import the Seamless SSO PowerShell module using this command: `Import-Module .\AzureADSSO.psd1`.
3. Run PowerShell as an Administrator. In PowerShell, call `New-AzureADSSOAuthenticationContext`. This command should give you a popup to enter your tenant's Hybrid Identity Administrator credentials.
4. Call `Get-AzureADSSOStatus | ConvertFrom-Json`. This command provides you with the list of AD forests (look at the "Domains" list) on which this feature has been enabled.
1. Navigate to the '$env:ProgramFiles"\Microsoft Azure Active Directory Connect"' folder.
2. Import the Seamless SSO PowerShell module using this command: 'Import-Module .\AzureADSSO.psd1'.
3. Run PowerShell as an Administrator. In PowerShell, call 'New-AzureADSSOAuthenticationContext'. This command should give you a popup to enter your tenant's Hybrid Identity Administrator credentials.
4. Call 'Get-AzureADSSOStatus | ConvertFrom-Json'. This command provides you with the list of AD forests (look at the "Domains" list) on which this feature has been enabled.
Comment on lines +158 to +161
Copy link

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These steps again show $env:ProgramFiles"\Microsoft Azure Active Directory Connect" (invalid PowerShell syntax) and wrap commands in single quotes. Please use a valid PowerShell path expression and format commands/identifiers as inline code (backticks).

Copilot uses AI. Check for mistakes.

**Step 3. Manually delete the `AZUREADSSO` computer account from each AD forest that you see listed.**
**Step 3. Manually delete the 'AZUREADSSO' computer account from each AD forest that you see listed.**

additionalContent: |

Expand Down