Hybrid deployment does not have Seamless SSO enabled

​

What this check verifies

Microsoft Entra hybrid deployments use Seamless Single Sign-On (SSO) to allow automatic authentication for domain-joined devices on the corporate network. This check verifies the actual Seamless SSO configuration in directory synchronization settings. Modern devices with Primary Refresh Token (PRT) support no longer require Seamless SSO.

​

Risk

Seamless SSO can be exploited for lateral movement between on-premises domains and Entra ID when an Entra Connect server is compromised. It can also be used to perform brute force attacks against Entra ID, as authentication through the AZUREADSSOACC account bypasses standard protections.

​

Recommendation

Disable Seamless SSO in hybrid environments where modern devices support Primary Refresh Token (PRT). Regularly audit Entra Connect settings and verify that the AZUREADSSOACC computer account is removed from Active Directory.

​

Remediation

Dashboard steps

1. Open Microsoft Entra Connect configuration tool on the on-premises server.
2. Navigate to Change User Sign In.
3. Uncheck Enable single sign-on.
4. Complete the configuration wizard.
5. In Active Directory, run Get-AzureADSSOStatus to verify Seamless SSO shows "enable":false.
6. Run Disable-AzureADSSOForest with domain admin credentials to remove the AZUREADSSOACC account.

​

References

• https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_seamless_sso_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks