Disable Entra Connect Seamless SSO

🔒 Secure Bits 💡
𝗬𝗼𝘂 𝗺𝗶𝗴𝗵𝘁 𝘄𝗮𝗻𝘁 𝘁𝗼 𝘁𝘂𝗿𝗻 𝗼𝗳𝗳 𝗘𝗻𝘁𝗿𝗮 𝗖𝗼𝗻𝗻𝗲𝗰𝘁 𝗦𝗲𝗮𝗺𝗹𝗲𝘀𝘀 𝗦𝗦𝗢. 𝗛𝗲𝗿𝗲’𝘀 𝘄𝗵𝘆.

In many hybrid Microsoft 365 tenants, Seamless SSO is still enabled — even though it’s no longer needed in modern Entra ID environments.

Nothing looks broken. Users sign in just fine.
And that’s exactly why this often goes unnoticed.

🤔 𝗪𝗵𝘆 𝗯𝗼𝘁𝗵𝗲𝗿?
Seamless SSO introduces an 𝗮𝗱𝗱𝗶𝘁𝗶𝗼𝗻𝗮𝗹 𝗮𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗺𝗲𝗰𝗵𝗮𝗻𝗶𝘀𝗺 that most environments don’t actually need anymore.

Modern Windows 10/11 devices already rely on 𝗣𝗿𝗶𝗺𝗮𝗿𝘆 𝗥𝗲𝗳𝗿𝗲𝘀𝗵 𝗧𝗼𝗸𝗲𝗻𝘀 (𝗣𝗥𝗧) for seamless access. Keeping Seamless SSO expands attack surface unnecessarily — without delivering any value.

Seamless SSO relies on Kerberos-based authentication. It uses a special on-prem AD computer account: 𝗔𝗭𝗨𝗥𝗘𝗔𝗗𝗦𝗦𝗢𝗔𝗖𝗖. That account holds a 𝘀𝗵𝗮𝗿𝗲𝗱 𝘀𝗲𝗰𝗿𝗲𝘁 between on-prem AD and Entra ID. If the secret gets compromised, it weakens your identity trust boundary.

🛠️ 𝗘𝘃𝗮𝗹𝘂𝗮𝘁𝗲 𝗶𝗳 𝘆𝗼𝘂 𝘀𝘁𝗶𝗹𝗹 𝗻𝗲𝗲𝗱 𝗦𝗲𝗮𝗺𝗹𝗲𝘀𝘀 𝗦𝗦𝗢
– Do you have Hybrid Entra Join + Windows 10/11?
– Are you trying to use Modern authentication wherever you can?
– No legacy domain-joined-only scenarios?

If the answer to above questions is yes, Seamless SSO is likely not needed.

🛡️ 𝗗𝗶𝘀𝗮𝗯𝗹𝗲 𝗦𝗲𝗮𝗺𝗹𝗲𝘀𝘀 𝗦𝗦𝗢 𝗶𝗻 𝗘𝗻𝘁𝗿𝗮 𝗖𝗼𝗻𝗻𝗲𝗰𝘁 𝗦𝘆𝗻𝗰
– Edit Microsoft Entra Connect configuration in the 𝘊𝘩𝘢𝘯𝘨𝘦 𝘶𝘴𝘦𝘳 𝘴𝘪𝘨𝘯-𝘪𝘯 section
– Uncheck 𝘌𝘯𝘢𝘣𝘭𝘦 𝘴𝘪𝘯𝘨𝘭𝘦 𝘴𝘪𝘨𝘯-𝘰𝘯
– Monitor sign-in behavior
– Validate PRT-based authentication continues to work
– Delete the AZUREADSSOACC afterwards

⚠️ 𝗜𝗺𝗽𝗼𝗿𝘁𝗮𝗻𝘁
– First, check whether Seamless SSO is active using 𝘈𝘶𝘥𝘪𝘵 𝘒𝘦𝘳𝘣𝘦𝘳𝘰𝘴 𝘚𝘦𝘳𝘷𝘪𝘤𝘦 𝘛𝘪𝘤𝘬𝘦𝘵 𝘖𝘱𝘦𝘳𝘢𝘵𝘪𝘰𝘯𝘴 GPO and logs
– Communicate with users before changing auth flows

✅ If you’re aiming for Zero Trust and cloud-native identity, 𝘀𝘁𝗮𝗿𝘁 𝗿𝗲𝗺𝗼𝘃𝗶𝗻𝗴 𝗮𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗽𝗮𝘁𝗵𝘀 you no longer need. If a feature exists only “because it always did”, it’s time to question it.

💬 Have you already disabled Seamless SSO or is it still running quietly in your environment?

𝘈𝘶𝘵𝘩𝘰𝘳 𝘰𝘧 𝘵𝘩𝘦 𝘱𝘰𝘴𝘵:
Martin Strnad