Troubleshoot single sign-on setup issues in Office 365, Intune, or Azure

How to troubleshoot SSO setup

Step 1: Prepare Active Directory

Setup guidance

Go to the following Microsoft website:

Validation for step 1

Use the Evaluating directory synchronization setup diagnostics wizard to scan Active Directory for issues that might cause directory synchronization issues.

Troubleshoot issues with validation for step 1

 

1. Note Incorrect preparation of Active Directory or failure to resolve issues that the tool identifies can result in directory synchronization problems. Follow the troubleshooting guidance that is offered by the Evaluating directory synchronization setup diagnostics wizard to correct the problems, and make sure that the diagnostics wizard runs without any errors. This prevents the following problems from occurring later in the implementation:
   • 2392130  Troubleshoot user name issues that occur for federated users when they sign in to Office 365, Azure, or Intune  
   • 2001616 A user's Office 365 email address unexpectedly contains an underscore character after directory synchronization
   • 2643629  One or more objects don't sync when using the Azure Active Directory Sync tool
2. Rerun the diagnostics wizard to check whether the issue is resolved.

Step 2: Active Directory Federation Services (AD FS) architecture

Setup guidance

Go to the following Microsoft websites:

Note Microsoft Support will not help customers with the execution of the setup guidance in these links.

• Plan your AD FS deployment
• Limiting access to Office 365 services based on the location of the client
• AD FS 2.0 Step-by-Step Guide: Integration with RSA SecurID in the Extranet

Step 4: Implement Active Directory synchronization

Setup guidance

Go to the following Microsoft websites:

• Directory synchronization roadmap
• Directory synchronization and source of authority

Validation for step 4

To validate, follow these steps:

1. Run the Azure Active Directory Module for Windows PowerShell as an admin.
2. Type the following commands. Make sure that you press Enter after you type each command.

   1. $cred=Get-Credential 

      
      
      Note When you're prompted, type your cloud service admin credentials.

   2. Connect-MsolService -Credential $cred 

      
      
      Note This command connects you to Azure AD. You must create a context that connects you to Azure AD before you run any of the additional cmdlets that are installed by the Azure Active Directory Module for Windows PowerShell.

   3. Get-MSOLCompanyInformation 

3. Check the LastDirSyncTime value from the output of the previous commands, and make sure that it shows a synchronization after the Azure Active Directory Sync Tool was installed.
   
   Note The date and time stamp for this value is displayed in Coordinated Universal Time (Greenwich Mean Time).
4. If LastDirSyncTime isn't updated, monitor the Application log of the server on which the Azure Active Directory Sync Tool is installed for the following event:
   • Source: Directory Synchronization
   • Event ID: 4
   • Level: Information
   This event indicates that directory synchronization finished on the server. When this happens, rerun these steps to make sure that the LastDirSyncTime value was updated appropriately.

Troubleshoot problems with validation for step 4

Troubleshoot common validation problems by using the following Microsoft Knowledge Base articles, as appropriate for your situation:

• 2386445   Error when you run the Azure Active Directory Sync tool: "Your version of the Windows Azure Active Directory Sync Configuration Wizard is outdated" 
• 2310320  Error when you try to run the Azure Active Directory Sync Tool Configuration Wizard: "Your credentials could not be authenticated. Retype your credentials and try again" 
• 2508225  "LogonUser() Failed with error code: 1789" after you enter enterprise administrator credentials in the Azure Active Directory Sync tool Configuration Wizard
• 2502710  "An unknown error occurred with the Microsoft Online Services Sign-in Assistant" error when you run the Azure Active Directory Sync Tool Configuration Wizard 
• 2419250  "The computer must be joined to a domain" error when you try to install the Azure Active Directory Sync Tool 
• 2643629  One or more objects don't sync when using the Azure Active Directory Sync tool
• 2641663 How to use SMTP matching to match on-premises user accounts to Office 365 user accounts for Directory Synchronization
• 2492140 You can't assign a federated domain to a user in the Office 365 portal

Step 5: Office 365 client preparedness

Setup guidance

1. Check client prerequisites for Office 365. For more information about the system requirements for Office 365, go to Office 365 system requirements.
2. Run Office 365 Desktop Setup on all client computers that use rich client applications. Rich client applications include Microsoft Outlook, Microsoft Lync 2010, Microsoft Office Professional Plus 2010, Azure Active Directory Module for Windows PowerShell. Office desktop applications, and Microsoft SharePoint integration applications. 
   
   Note Office 365 Desktop Setup is available at http://g.microsoftonline.com/0BX10en/436?!Office365DesktopSetup.application.
3. If a seamless, no-prompt experience is expected for domain-joined and domain-connected client computers, add the AD FS Federation Service URL to the local intranet zone in Windows Internet Explorer. For example, do the following:
   1. In Internet Explorer, on the Tools menu, click Internet Options.
   2. Click the Security tab, click Local intranet, click Sites, and then click Advanced.
   3. Type https://sts.contoso.com in the Add this website to the zone box, and then click Add.
      
      Note "sts.contoso.com" represents the FQDN of the AD FS Federation Service.
   For more information about this configuration, see the following Microsoft Knowledge Base article:
   2535227  A federated user is prompted unexpectedly to enter their work or school account credentials
4. If domain-joined and domain-connected client computers access Internet resources by using a proxy server that resolves Internet addresses by using public DNS queries (and not internal, split-brain DNS), add the AD FS Federation Service URL to the list for which Internet Explorer will bypass proxy filtering. The following is an example of how to add the URL to the Internet Explorer exceptions list:
   1. In Internet Explorer, on the Tools menu, click Internet Options.
   2. On the Connections tab, click LAN settings, and then click Advanced.
   3. In the Exceptions box, enter the value by using the fully qualified DNS name of the AD FS service endpoint name. For example, enter sts.contoso.com.

Validation for step 5

To validate, follow these steps:

1. Make sure that Microsoft Online Services Sign-in Assistant service is installed and running. To do this, follow these steps:
   1. Click Start, click Run, type Services.msc, and then click OK.
   2. Locate the Microsoft Online Services Sign-in Assistant entry, and then make sure that the service is running.
   3. If the service isn't running, right-click the entry, and then select Start.
2. Go to the AD FS MEX website to make sure that the endpoint is part of the Internet Explorer intranet security zone. To do this, follow these steps:
   1. Start Internet Explorer, and then go to the AD FS service endpoint website. The following is an example of a service endpoint website:
      https://sts.contoso.com/federationmetadata/2007-06/federationmetadata.xml
   2. Check the status bar at the bottom of the window to make sure that the security zone that's indicated for this URL is Local intranet.

Step 6: Final validation

On a configured client computer, test the expected SSO authentication experience. To do this, authenticate by using a federated user account. You may want to test authentication of a federated user in the following scenarios:

• In the on-premises network and authenticated to the on-premises Active Directory
• From an Internet-neutral IP location and not authenticated to the on-premises Active Directory

To validate, follow these steps:

1. Test web authentication. To do this, use one of the following methods:
   • Sign in to the cloud service portal as a federated user by using local Active Directory credentials.
   • Sign in to Outlook Web App as a federated user (by using local Active Directory credentials) who has an Exchange Online mailbox. For example, sign in to Outlook Web App at the following URL:
     https://outlook.com/owa/contoso.com
     Note In this URL, "contoso.com" represents the federated domain name.
   • Sign in to Microsoft SharePoint Online as a federated user (by using local Active Directory credentials) who has access to the Team Site collection. For example, sign in to SharePoint Online at the following URL:
     http://contoso.sharepoint.com
     Note In this URL, "contoso" represents your organization's name.
2. Test rich client or active requestor authentication. To do this, follow these steps:
   1. Configure a Skype for Business Online (formerly Lync Online) client profile for a federated user account, and then sign in to the account by using local Active Directory credentials.
   2. Sign in to Azure Active Directory Module for Windows PowerShell by using a federated user account that has global admin credentials through the connect-MSOLService cmdlet.
3. Test Exchange Online basic authentication by using Microsoft Remote Connectivity Analyzer. For more information about how to use Remote Connectivity Analyzer, see the following article in the Microsoft Knowledge Base: 
   2650717   How to use Remote Connectivity Analyzer to troubleshoot single sign-on issues for Office 365, Azure, or Intune 

Still need help? Go to Microsoft Community or the Azure Active Directory Forums website.