According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and Microsoft Learn module "Plan and implement Azure AD Seamless Single Sign-On (SSO)", Azure AD Seamless SSO allows domain-joined Windows devices (that are not necessarily Azure AD-joined) to automatically sign in to Azure AD without requiring users to re-enter their credentials.
When a user tries to access an Azure AD-integrated application (like Microsoft 365, Teams, or SharePoint Online), Azure AD redirects the authentication request to the on-premises Active Directory. The Seamless SSO feature uses a computer account (AZUREADSSOACC) created in Active Directory to authenticate users through Kerberos tickets automatically.
For the Kerberos-based SSO to work properly in a browser or client, the service principal name (SPN) used by Azure AD must be treated as a trusted intranet site. This ensures that Integrated Windows Authentication (IWA) can pass the user's Kerberos ticket automatically - without prompting for credentials.
To enable automatic SSO without credential prompts, you must:
* Add the following URLs to the Intranet Zone in Internet Explorer or Microsoft Edge (and by extension, Windows Authentication settings):
* https://autologon.microsoftazuread-sso.com
* https://aadg.windows.net.nsatc.net
* Ensure Automatic logon with current user name and password is enabled for the Intranet Zone.
"For Azure AD Seamless SSO to work, the client machines must be on the corporate network and the URLs
'https://autologon.microsoftazuread-sso.com' and 'https://aadg.windows.net.nsatc.net' must be added to the users' Intranet zone settings." Other options are not correct because:
* A. Enable Enterprise State Roaming - Manages user settings across devices, unrelated to SSO.
* B. Configure Sign-in options - User-level authentication preferences, not required for Seamless SSO.
* C. Install Azure AD Connect Authentication Agent - Used for Pass-through Authentication (PTA), not for Seamless SSO.