SSO for Azure AD Apps: Ways to Setup

SSO for Azure AD Apps: Ways to Setup

Most business organizations rely on Microsoft Active Directory or it's hybrid offering, Azure AD to manage users and carry out day-to-day essential IT tasks. However, it is not uncommon to find businesses using directory services to control access to other business applications that are used in the organization. This can be an internal communication application, a mail-hosting service, or any sales enablement applications.
 
Since these SaaS applications depend on their own native user directories to provision access and permissions, end users have been forced to remember credentials of not only their Windows network, but for each SaaS application they use as well. This proved to be a hassle as the number of applications the end users used grew, the more number of credentials they had to remember. This lead to an increase in helpdesk calls and poor password habits. In addition to this, administrators had to painstakingly manually map AD users to corresponding accounts in SaaS applications.
 
To eliminate such hassles and ensure a seamless user experience for the end user, Single Sign-On (SSO) was established. With SSO,  users could sign on to the Windows network once, and then easily gain access to their SaaS applications without having to enter an additional set of credentials.
 
There are three ways with which an Hybrid Active Directory can integrate with SaaS applications to enable SSO. They are: 
  1. Independent Integrations with AD
  2. Leveraging Microsoft AD Federation Services (AD FS)
  3. Using third-party solutions 

Independent Integrations with AD   

Most popular SaaS applications offer their own AD integration tool. If that is not the case, their API can be used to develop a close integration between your hybrid directory service and the application. However, the drawback of these independent integrations is the need to install and maintain tools from each SaaS application vendor. With the dependence on SaaS applications growing, organizations will have to maintain a portfolio of such tools for all the SaaS applications, which increases IT costs and complexity. 

Leveraging Microsoft AD Federation Services (AD FS)    

Microsoft released Active Directory Federation Services (AD FS) 2.0 during the launch of their Windows Server 2008 R2. It provided organizations with a comprehensive way of dealing with SSO for third-party applications. However, the downside with leveraging AD FS for enabling SSO was that it does not support user synchronization, nor does it address user provisioning or de-provisioning, natively.  

Using Third-Party Solution   

Unlike the application's own integration tools, third-party companies provide complete solutions to integrate existing hybrid AD infrastructure to extend SSO to end users. 

    • Related Articles

    • 2FA for Azure AD Apps: How to Enable using Conditional Access Policies

      Configuring Two Factor Authentication for Cloud Apps in Azure AD In an earlier post, we discussed in depth about how single sign-on (SSO) for cloud apps in hybrid Active Directory works and the various methods of implementing it. However, SSO alone ...

    • Detecting changes in privileged accounts in Azure AD

      Monitoring and protecting privileged accounts is paramount because failure to do so can lead to loss or theft of sensitive information, or enable malware to compromise your network. Privileged accounts can include global administrators, Azure ...

    • How to Sync On-premises Active Directory with Azure Active Directory

      Synchronizing users and groups from On-premises Active Directory to Azure Active Directory Azure Active Directory is a multi-tenant, cloud-based directory and identity management service provided by Microsoft. It offers identity and access ...

    • Enable Self-service password reset in a Azure Active Directory

      Enable Users to Reset Passwords using Azure Active Directory Password reset tickets constitute a major chunk of the help desk ticket pile. Allowing users to reset their own passwords is a sure way of boosting productivity. Microsoft Azure Active ...

    • AD object classification

      Active directory objects can be classified into two broad types. 1. Security principal objects 2. Resources Security principal objects The objects that can be authenticated by AD are called security principal objects. These objects have unique ...