Forum Discussion

Avi Vaid's avatar
Avi Vaid
Icon for Microsoft rankMicrosoft
Feb 20, 2020

Updates to auto sign in with on-prem Active Directory accounts

We've heard your feedback and are committed to making your identity experience great. In Edge Beta 81.0.416.11 and version 82.0.427.0 onwards, On-prem Active Directory account auto sign in (sign in with accounts of the type DOMAIN\username) will only be targeted to organizations that enable it. 

 

If an organization does not turn this feature on, users will only be auto signed in with the primary account on their operating system if it is an MSA or an AAD account. If there is no primary account or the primary account is an on-prem Active Directory account, users will not be signed into Microsoft Edge. Users that were auto signed in with their on-prem Active Directory accounts in a previous release will be able to sign out of it when they upgrade to newer versions of Microsoft Edge.

 

If you are an admin and you would like your users to be auto signed in with their on-prem Active Directory accounts, you can use the ConfigureOnPremisesAccountAutoSignIn (https://docs.microsoft.com/en-US/DeployEdge/microsoft-edge-policies#configureonpremisesaccountautosignin) policy to enable this. If you'd like to have your users auto signed in with their AAD accounts instead, please hybrid join your environment (https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-federated-domains).

 

We hope that this helps make your Identity experience in Microsoft Edge better. Let us know if there is anything we could do to make this experience better. Thanks!

  • sheffieldc's avatar
    sheffieldc
    Brass Contributor
    Mar 27, 2020

    Avi Vaid

     

    Hi Avi

     

    Are you able to clarify a couple of points for me?

     

    We have on-premise AD, Azure AD Connect syncing users to Office 365, with all services cloud-hosted. I thought I might be able to get automatic sign-in to each user's Office 365 identity in the same way Office apps do but from reading your post it sounds like this isn't possible (yet?)

     

    1. (I hope this doesn't sound facetious.) What is the benefit of having the user sign into Edge with the on-premise AD account, if not to sync with the associated AzureAD/Office365 identity? Does it just improve authentication with on-premise services?

     

    2. If we hybrid-join our domain PCs, will users that login in the standard way (DOMAIN\Username) then be signed in with their AzureAD/Office365 identity automatically? Or do they then need to start logging in using their e-mail address or similar?

     

    Cheers!
    Chris

    • Avi Vaid's avatar
      Avi Vaid
      Icon for Microsoft rankMicrosoft
      Mar 30, 2020

      sheffieldc Chris, great questions. As of now we don't have a way to get auto sign in with the O365 account without hybrid joining. Some thoughts on your questions below:

      1. The benefits are having a specified work profile, this helps with windows information protection features. It will also come into play in the future when we enable on-premise sync and if we create preferred SSO with the signed in account
      2. Yes. If you hybrid join your domain PC, users can log into windows as DOMAIN\Username and then be signed into Edge with their AAD (O365) accounts automatically.