According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and Exam Ref SC-300, Azure AD Seamless Single Sign-On (SSO) allows users on corporate Windows 10 devices connected to the corporate network to automatically sign in to Azure AD-connected services such as Microsoft 365 or Azure without needing to re-enter their credentials.
Seamless SSO works by automatically signing users in using their on-premises Active Directory credentials when they are on the corporate network. This feature is enabled through Azure AD Connect and uses a service account (AZUREADSSOACC) to securely communicate authentication tokens.
However, for Azure AD Seamless SSO to function correctly on domain-joined Windows 10 computers, specific browser configurations are required. In particular, users must be able to automatically authenticate to the Azure AD SSO endpoint (https://autologon.microsoftazuread-sso.com).
The Microsoft documentation specifies:
"To enable Seamless SSO on Windows devices, ensure that the Azure AD SSO URL (https://autologon.
microsoftazuread-sso.com) is added to the Local intranet zone in Internet Explorer or Microsoft Edge (IE mode). This allows the browser to use the user's current Windows credentials for integrated authentication without prompting." Therefore:
* Option A (Modify the Local intranet zone settings) is correct - adding the Azure AD SSO URL to the Local intranet zone allows integrated Windows authentication to pass through automatically, enabling seamless sign-on.
* Option B (Configure Sign-in options from the Settings app) applies to user-specific credential management but not domain-wide SSO configuration.
* Option C (Enable Enterprise State Roaming) synchronizes settings and credentials across devices but does not enable seamless SSO.
* Option D (Install the Azure AD Connect Authentication Agent) is used for Pass-through Authentication, not Seamless SSO.
From Microsoft Learn's "Plan, deploy, and manage Azure AD Seamless SSO" module:
"To enable users to sign in automatically, configure the browsers and add the Azure AD SSO service URL to the Local intranet security zone. This ensures credentials are passed transparently for single sign-on."