How to Connect Active Directory Server to Entra ID and Enable Single Sign-On

How to Connect Active Directory Server to Entra ID and Enable Single Sign-On

Integrating an on-premises Active Directory (AD) server with Microsoft Entra ID (formerly Azure AD) enables organizations to extend their local directory services to the cloud. This setup allows seamless user authentication and Single Sign-On (SSO) to cloud applications. The primary authentication protocol used for SSO in this integration is WS-Federation, SAML, and OAuth 2.0, facilitated by Azure AD Connect.

Step-by-Step Guide to Integrating Active Directory with Entra ID

Step 1: Prepare Your Environment

Before integrating, ensure that:

• You have Global Administrator access to Entra ID.
• Your on-premises Active Directory is running and healthy.
• The Azure AD Connect tool is installed on a Windows Server (2016 or later).
• Your domain is verified in Entra ID.

Step 2: Install and Configure Azure AD Connect

1. Download Azure AD Connect from Microsoft’s official site.
2. Run the installer and select Customize to configure advanced options.
3. Choose Federation with AD FS or Password Hash Synchronization as your authentication method.
4. Enter your Entra ID admin credentials and Active Directory domain admin credentials.
5. Select the Organizational Units (OUs) and users to sync.
6. Configure Azure AD sign-in using UPN (User Principal Name) for identity mapping.
7. Click Install and wait for the synchronization to complete.

Step 3: Enable Single Sign-On (SSO)

1. Go to Entra ID Admin Center (entra.microsoft.com).
2. Navigate to Identity > Hybrid Identity > Azure AD Connect.
3. Select Seamless Single Sign-On and enable it.
4. Run the following PowerShell command on your AD server to configure SSO:Import-Module AzureADSSO Enable-AzureADSSOForest
5. Restart the server to apply the changes.

Step 4: Configure Federation for Advanced SSO (Optional)

If you require Federated SSO, use Active Directory Federation Services (AD FS):

1. Install AD FS Role on a Windows Server.
2. Configure Claims-based Authentication.
3. Establish a trust relationship between AD FS and Entra ID.
4. Configure WS-Federation or SAML authentication for your cloud applications.

Step 5: Test and Monitor Synchronization

1. Open Azure AD Connect Health to check sync status.
2. Log in to Microsoft 365 or an Azure-integrated app to test SSO.
3. Ensure that users can log in without entering credentials multiple times.

Step 6: Enforce Security Best Practices

• Enable Multi-Factor Authentication (MFA) for extra security.
• Set up Conditional Access Policies for user authentication.
• Regularly monitor and audit sign-in logs.

Conclusion

By integrating Active Directory with Entra ID, organizations enable secure, seamless authentication across both on-premises and cloud environments. This approach leverages WS-Federation, SAML, and OAuth 2.0 protocols to facilitate Single Sign-On (SSO) and improve user experience.

Detailed troubleshooting steps for any integration challenges.

Here are detailed troubleshooting steps for common issues when integrating Active Directory (AD) with Entra ID and enabling Single Sign-On (SSO):

---

Troubleshooting Common Integration Issues

1. Azure AD Connect Sync Issues

If Azure AD Connect is not syncing users or groups properly, follow these steps:

✅ Check Sync Status:

• Open Azure AD Connect and ensure that synchronization is enabled.
• Run the following PowerShell command to check sync status:

  Get-ADSyncScheduler
  

• If sync is disabled, enable it using:

  Set-ADSyncScheduler -SyncCycleEnabled $true
  

✅ Manually Trigger a Sync:

Start-ADSyncSyncCycle -PolicyType Delta

✅ Verify Sync Errors:

• Open Synchronization Service Manager (miisclient.exe) on the Azure AD Connect server.
• Look for errors under the Operations tab.

✅ Check UPN Suffix Matching:

• Ensure that users’ User Principal Names (UPN) in on-premises AD match their Entra ID accounts.
• If UPNs are incorrect, update them in Active Directory Users and Computers (ADUC).

---

2. Single Sign-On (SSO) Not Working

If users are being prompted for passwords even after enabling SSO, try the following:

✅ Check If SSO Is Enabled in Entra ID:

• Run the following PowerShell command:

  Get-AzureADSSOStatus
  

• If SSO is disabled, enable it using:

  Enable-AzureADSSOForest
  

✅ Ensure Kerberos Authentication Is Configured Correctly:

• Verify that the Azure AD Kerberos Key Distribution Center (KDC) is properly configured.
• Run:

  klist get krbtgt/AzureADSSOAcc
  

• If the Kerberos ticket is missing, restart the authentication service on your AD server.

✅ Check Local Intranet Settings (For Seamless SSO on Browsers):

• Ensure that https://autologon.microsoftazuread-sso.com is added to Trusted Sites in Internet Explorer or Edge.

---

3. AD FS Federation Issues (For Advanced SSO)

If using Active Directory Federation Services (AD FS) for federated SSO, check:

✅ Verify AD FS Trust Relationship with Entra ID:

• Run the following PowerShell command on the AD FS server:

  Get-AdfsRelyingPartyTrust
  

• Ensure Entra ID (https://login.microsoftonline.com) is listed.

✅ Check SSL Certificate Issues:

• Run:

  Get-AdfsCertificate
  

• If the SSL certificate has expired, renew it and rebind it in IIS and AD FS.

✅ Validate Claims Rules Configuration:

• Open AD FS Management → Relying Party Trusts → Microsoft 365.
• Ensure the following claims rules are configured:
  • UPN Claim (e.g., User-Principal-Name → Name ID)
  • ImmutableID Mapping (ObjectGUID → ImmutableID)

✅ Test Federation Authentication:

• Use this URL to check AD FS login:

  https://<ADFS_Server>/adfs/ls/IdpInitiatedSignOn.aspx
  

• If login fails, check Event Viewer logs under:

  Applications and Services Logs > AD FS > Admin
  

---

4. Entra ID Sign-In Logs & Monitoring

If users face sign-in errors, check Azure Sign-In Logs:

✅ View Sign-In Logs:

• Go to Microsoft Entra ID Admin Center (entra.microsoft.com)
• Navigate to Monitoring & health → Sign-in logs.
• Look for error codes (e.g., 50155 for SSO failures).

✅ Use Azure AD Connect Health:

• Install Azure AD Connect Health Agent for detailed diagnostics.
• Check sync, authentication, and identity protection alerts.

---

Conclusion

By following these troubleshooting steps, you can resolve most integration challenges between Active Directory and Entra ID. Would you like additional details on specific error codes or log analysis techniques? 🚀