If an application (for example, ) forwards a domain_hint (OpenID Connect) or whr (SAML) parameter - identifying your tenant, or login_hint parameter - identifying the user, in its Azure AD sign-in request, users are automatically signed in without them entering usernames or passwords.If it fails for any reason, the user sign-in experience goes back to its regular behavior - i.e, the user needs to enter their password on the sign-in page. Seamless SSO is an opportunistic feature.Both use cases work because Seamless SSO uses the securityIdentifier claim in the Kerberos ticket to look up the corresponding user object in Azure AD. Sign-in username can be either the on-premises default username ( userPrincipalName) or another attribute configured in Azure AD Connect ( Alternate ID).This capability needs you to use version 2.1 or later of the workplace-join client. Register non-Windows 10 devices with Azure AD without the need for any AD FS infrastructure.Can be rolled out to some or all your users using Group Policy.Works with any method of cloud authentication - Password Hash Synchronization or Pass-through Authentication.No additional components needed on-premises to make this work.Users don't have to enter their passwords repeatedly.Users are automatically signed into both on-premises and cloud-based applications.

SSO via PRT works once devices are registered with Azure AD for hybrid Azure AD joined, Azure AD joined or personal registered devices via Add Work or School Account.įor more information on how SSO works with Windows 10 using PRT, see: Primary Refresh Token (PRT) and Azure AD Key benefits

SSO on Azure AD joined, Hybrid Azure AD joined, and Azure AD registered devices works based on the Primary Refresh Token (PRT) Seamless SSO needs the user's device to be domain-joined, but it isn't used on Windows 10 Azure AD joined devices or hybrid Azure AD joined devices. For Windows 7 and Windows 8.1, it’s recommended to use Seamless SSO. Seamless SSOįor Windows 10, Windows Server 2016 and later versions, it’s recommended to use SSO via primary refresh token (PRT).

Seamless SSO is not applicable to Active Directory Federation Services (ADFS). Seamless SSO can be combined with either the Password Hash Synchronization or Pass-through Authentication sign-in methods.