When syncing local AD users to Azure AD, you can configure Seamless Sign-On to automatically login to Microsoft 365 Apps like Sharepoint Online, OneDrive, or Exchange Online. This is very easy to do and will make logins for users less painful.

Assuming Azure AD Connect is already set up with Pass-through authentication (see https://www.ajni.it/2021/05/configuring-azure-ad-connect-for-user-synchronization/), just open Azure AD Connect and then hit “change user sign-in” and log in with an Azure AD Global admin. After that, select “Enable single sign-on”.

Enter Domain Admin credentials.

When the pre-checks is complete, hit configure and exit.

A Computer Account named AZUREADSSOACC will be created in Active Directory which allows the authentication validation between Azure AD and local Active Directory. The Kerberos decryption key is saved in the cloud and should be changed regularly. You can see that on the Computer account, service principal names are configured

Lastly, you can roll out the feature with Group Policy. The URL https://autologon.microsoftazuread-sso.com must be added to the intranet zone list, which allows the browser to send Kerberos tickets to that site.

The GPO can be found under User Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Site to Zone Assignment List.

Status bar updates via script must be also enabled. This GPO is located under User Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Intranet Zone > Allow updates to status bar via script.

You can test the feature by opening portal.office.com. After entering the username, login should be done automatically without needing to insert a password.

References:

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-quick-start

The first step in the journey to the cloud is to install and configure Azure AD Connect. This will synchronize users in local Active Directory to Azure AD and will allow you to use cloud services like OneDrive For Business, Sharepoint Online, Exchange Online, or Microsoft Teams.

Before installing the service itself, we have to set an alternate UPN suffix as in Azure AD. In Active Directory Domains and Trusts add a new UPN suffix. The suffix should be equal to the custom domain name in Azure AD.

Users synchronizing to Azure AD should have that UPN suffix set:

In the Azure AD panel, select Azure AD Connect and then “Download Azure AD Connect”

Start the installer and select “Customize”

Hit install

Select Password Hash Synchronization and login with your Azure AD global admin

Select Create new AD Account and enter Enterprise Admin credentials. The tool will automatically set the correct permission on the OU without adding Domain Admin rights to the user.

You will notice that a new user named MSOL_xxx has been created.

This is just a warning. We already set the correct UPN suffix.

Deselect the top checkbox and select the OU containing AD Users. Service users should not be synchronized.

Leave everything else on default settings and then hit install.

With the synchronization service you can check what objects have been synced and the last time a sync ran.

In Azure AD the synced user should show up. You can see that the correct UPN has been configured on the user.

If you want to manually start AD Sync, in Windows PowerShell enter this command:

Start-ADSyncSyncCycle -PolicyType Delta

In this day and age having an on-premise Active Directory is not mandatory, especially if you are a small and/or new organization. Most of the services will be in Microsoft 365 anyways, so why bother maintaining local AD?

If you have an Azure Active Directory Tenant, users are allowed to join Windows 10 devices to the AAD domain by default.

In the AAD Portal, under Devices > Device Settings, settings can be adjusted to the organization’s needs.

Joining the device is very easy. Just open the modern Settings app in Windows 10 > Accounts > Access work or school > + Connect. Then select Join this device to Azure Active Directory.

After logging off, any user that is a member of the tenant can log in with their email address/Azure AD account.

If you do hate passwords, this new feature from Microsoft might have solved that problem. With this feature, a user can send a push notification to Microsoft Authenticator, allowing access to any Microsoft 365 site without entering a password.

First of all, enable the so called “combined registration experience” in Azure AD under User settings.

Since I have a new tenant, the feature is automatically enabled for me.

After that, browse to Security > Authentication Methods > Policies. Select Microsoft Authenticator and enable it.

Users are not forced to use the new authentication method. They have to set that up themselves at https://aka.ms/mysecurityinfo.

Select Authenticator App as the method.

Download Microsoft Authenticator on the mobile phone.

Scan the QR code shown there.

Inside the Microsoft Authenticator app, select “Set up phone sign-in” and follow the wizard.

Now, upon logging in, you can select “User an app instead”. This will trigger a notification on the phone app.

References:

https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-phone

Getting started with Microsoft 365/Exchange Online in 2021 is very easy and relatively cheap (I am paying 5 bucks a month for one mailbox and some extra stuff, like 1 TB of OneDrive storage).

Roughly speaking, here are the high level steps from beginning to end:

• Create your subscription
• Add a custom domain
• Verify the domain
• Add DNS entries for MX, Autodiscover, and SPF
• Create users
• License users
• Wait some minutes to see the mailbox in Exchange Online
• Add account in Outlook

After creating your tenant (easy to do, you can also work with a third party, instead of buying the subscription directly off of Microsoft), open https://admin.microsoft.com and select Azure AD. Unser Custom domain names, add the organization’s domain.

You verify the domain by adding a TXT record to at the root of your domain. You could also verify by MX record, but usually the organization has some sort of functioning mail product, so in a migration scenario that is not an option.

@ means the root of your domain. In my case ajni.it

Due to DNS Time To Live (TTL) and caching, this might take some time.

Back to the Microsoft 365 Admin Center, under Settings > Domains select the newly added domain and then Continue setup. Add the 3 records to your DNS.

Select Add your own DNS records. For mailing, Exchange Online and Exchange Online Protection records are needed.

After correctly adding DNS records for Exchange Online, add a user in Azure Active Directory and assign the license. Very straightforward. Set usage location to your organization’s country. If you do not specify a usage location, licenses cannot be assigned to that user.

Under License the license can be assigned.

You could also choose to selectively assign certain products of the subscription. Either way one license will be burned.

It takes some minutes for the mailbox to show up in Exchange Online after assigning the license.

From now on, the account can be added in Outlook or accessed through Outlook on the Web https://outlook.office365.com