I'm having the darndest time getting SSO to work Office 365. I've reviewed this article https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-quick-start so many times and everything looks good. I'm not doing hybrid, at the moment. I'm just trying to test with myapps.microsoft.com, but have also tried adding /domain.microsoft.com and just https://myapps.microsoft.com/userdomain.com, but not having much luck. Every time it just prompts for username and password. Been googling this for days now and I'm spinning my wheels. Anyone have any good troubleshooting steps to take in order to better diagnose?

The guide you posted is for Seamless SSO. Is that the method you're trying to use, or are you using Hybrid joining as well? Can you also let us know what platform you're doing this on, Citrix or VMware, or other?

might be on to something, two different environments where I've started over on a net new profile and now it seems to be working

Just an FYI, there are two primary modes for Azure SSO. The first is Seamless, which is older but works great with VDI platforms, and doesn't require hybrid domain joining. Or there's the newer method that uses Hybrid Domain Joined VDI with SSO PRT (Primary Refresh Tokens) as the method. I've got a post and video here if it helps: https://www.stephenwagner.com/2022/03/06/microsoft-azure-ad-sso-vdi/ Also have this post covering PRTS and HAADJ: https://www.stephenwagner.com/2023/07/23/hybrid-azure-ad-join-azure-ad-connect-vdi/

thanks for that

@Steve Noel, I don't think so, but it's possible. Keep in mind that the cred windows aren't always a 100%, and it's not easy to tell if it's due to prompting for Office app sign-in, activation, or both (they are two separate processes). If using Azure PRTs, there's a chance the PRT token hasn't been created yet, if you're getting prompted, close and re-open with an additional prompt. There might be a few other scenarios that also apply.

i have the outlook profiels being auto created by the "Automatically configure profile based on Active Directory Primary SMTP address (one-time only)" GPO, so the first couple prompts are now gone, so basically on first run it gives these two. After clicking "sign in" on the first one, you get the 'activate office' prompt

Do you have it set to auto login? Also, when you sign in, does it require an MFA? If MFA is required, that's probably what is triggering the sign on.

There's autodiscover setup and all that. Is there a specific auto login GPO? There's no MFA prompt at all, if i walk through it manually.

There's a GPO for auto login with federated credentials. I noticed this signs in, even if not using ADFS.

ah, i didn't set that one, thought it was ADFS specific

Is this on persistent or non persistent?

non

If you're using non-persistent, are you making sure that after changing settings the GPOs, you're accounting for the GPO cache from when you provisioned? For example, if using Horizon, GPOs are cached during ClonePrep when provisioning a snapshot. If you change any GPOs, you need to trigger cloneprep to run again for domain join and GPO cache (usually done by taking another snapshot and pushing from the base)

no, no hybrid join or anything, just SSO

when you say SSO, do you mean Azure Seamless SSO than if you're not using Azure PRT SSO?

correct, the entra connect SSO checkbox, iwth password hash

If you're using Seamless SSO, have you fully configured it? Or only done the check box?

waiting to get more details on the full configuration of it, but it's enabled on the azure side, where it says seamless Sso enabled - yes. Need to confirm what accounts/ous/objects are being synced

Seamless SSO doesn't matter if the objects are being sync'ed or not, that's only Azure SSO with PRT. If you're choosing to use Seamless SSO you need to fully configure it, checking the box isn't enough

i followed this one: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-quick-start

And you've configured all the intranet zones for the GPOs for the clients for it to work?

yes sir, and that enable script one, and the https one

And the GPOs were probably cached in your base image during provisioning?

i believe most of them are user settings

Is the Office identity key in the registry persisting across sessions? It should be gettting deleted.

right now i'm just starting off with net new profiles, so basically it's like the first time the user logs in

If the VDI isn't hybrid domain joined, you won't be able to do much with conditional access policies.

You can still control access to office 365 from it