Entra Seamless SSO Not Working: A Read-First Intranet Zone, Kerberos Ticket, and AZUREADSSOACC Triage
Helpdesk: "Outlook on the web used to just open on my desk PC. Now it asks for my password every morning." A second ticket from the same floor: the sign-in page takes the username, pauses, then wants a password, and only for people on the older domain-joined laptops. Someone has already proposed "turn Seamless SSO off and on again," running the key rollover a second time to be safe, or adding…
Helpdesk reported that Outlook on the web began requesting passwords daily when used on a desk PC. Similarly, a second ticket from the same floor noted the sign-in page accepting the username but requesting a password, affecting only those on older domain-joined laptops. Someone suggested disabling and re-enabling Seamless SSO, rerunning the key rollover, or adding autologon.microsoftazuread-sso.com to Trusted sites for everyone.
Microsoft Entra Seamless SSO operates opportunistically, falling back to a regular password prompt if any link fails. For the issue to manifest, the device must utilize Seamless SSO, the tenant must enable it for the user's AD forest, the browser or Office client must treat https://autologon.microsoftazuread-sso.com as a Local intranet with scripting allowed, and the device must connect to a domain controller with a correct clock to obtain a ticket for the AZUREADSSOACC computer account.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
