Down to my final issue with OneDrive inside non-pe...
# citrix-vadp
Paul Brown
04/16/2024, 11:58 AMDown to my final issue with OneDrive inside non-persistent MCS machines. How to make it automatically log you in? Have the GP set as per documentation, Semi persistent VMs have no issue, but non persistent refuse to comply. Is my only option to make them hybrid joined?
r
Robert Berggren
04/16/2024, 12:14 PMNot necessary to hybrid join. You need Tennant:ID and "sliently login with user..."- something configured in GPO. If you are able to SSO to portal.office.com it should work.
p
Paul Brown
04/16/2024, 1:52 PMThat seems to be one of my issues. SSO to portal.office.com fails on these MCS non persistent..
r
Robert Berggren
04/16/2024, 1:53 PMa
Aaron Parker
04/17/2024, 4:21 PMEntra hybrid join is the far better approach. Users will automatically receive a PRT on sign-in and therefore SSO into Entra ID apps (browser, Office, OneDrive etc.), and you can target these devices in CA policies.
Aaron Parker
04/17/2024, 4:22 PMHere’s a couple of good reasons for not enabling SSSO:
• Undetected Azure Active Directory Brute-Force Attacks - it is possible to perform brute force attacks against SSSO; however, Microsoft recommend ensuring that Smart Lockout is enabled
• Azure AD SSSO - Azure AD Kerberos Tickets: Pivoting to the Cloud - this article covers a method of abusing the Kerberos decryption key to gain access to an Entra ID tenant
Additionally, I rarely see the Kerberos key used by SSSO being rolled over every 30 days as recommended by MS.
p
Paul Brown
04/29/2024, 2:39 PMGoogling hybrid join with MCS gives a “ this is not supported by Microsoft” Citrix KB. But then the link to MS in that KB says it is supported…
2 Views