Azure AD SSO and Disabled Computer Accounts

When you set up Azure AD SSO, the Azure AD Connect application creates a computer account called AZUREADSSOACC. Do not disable this account, or SSO stops working.

I’ve had a few clients in the past week disable this when generally disabling all the computer accounts that have not logged in for X days.

Therefore if you have Azure AD SSO enabled, I suggest updating your documentation on disabling computer accounts – ‘cause not all computer accounts actually login as computers (I’m thinking Cluster services here as well) and consider actually whether or not disabling accounts for computers that are not logging in any more is necessary.

Then also take the AZUREADSSOACC account and set a description on it saying do not disable!

Posted

15 September 2017

Authentication, Azure Active Directory, Azure AD, Office, Office 365, SSO

Brian Reid

Tags:

Comments

5 responses to “Azure AD SSO and Disabled Computer Accounts”

Filip

18 September 2017

Azure AD SSO is in preview and only for password sync or passthrough auth. What is Your opinion about Azure AD SSO (& passthrough auth) vs. ADFS?

Reply
1. Brian Reid
  
  10 October 2017
  
  Its now in GA as off Ignite the other week. I would opt for SSO over ADFS unless you still had or need to block legacy auth applications.
  
  Reply
  1. Filip
    
    10 October 2017
    
    Thanks Brian, i read that only modern authentication is supported, thus office and edge. Do you know if IE, Chrome etc support modern auth? And is there a list or baseline which apps support this SSO?
    
    Reply
    1. Brian Reid
      
      11 October 2017
      
      All browsers do modern auth, as “modern auth” is a browser based control. All apps (mobile) apart from ActiveSync do modern auth. Only Office 2016 and later does modern auth for the Office suite. Office 2013 requires a update and registry keys to enable it.
      
      Reply
      1. Filip
        
        11 October 2017
        
        Thank you very much for your information. Sounds like PTA and SSO are a better choice mainstream. When using azure ad we then can federate our saas apps with azure ad saml so no need for adfs there also!

Azure AD SSO and Disabled Computer Accounts

Comments

5 responses to “Azure AD SSO and Disabled Computer Accounts”

Leave a Reply to Brian Reid Cancel reply