Hi, How can a service account in active directory sign in to azure with ADFS? It seems like when using ADFS, the domain user has to enter his credentials to a login page. What should a service account do in the same case (as it is not an interactive user...)? Can Entra ID define if it is a service account or a regular domain user based on its sign in details or any other details? Thanks

Hi @Adi Malyanker If you want create a service account Cloud only in Entra ID , yu should shoose a non federated domain (xxxx.onmicrosoft.com) to bypass federation redirection for service account authentication: If the service account is a synced account , it will be redirected to federation service for authentication. Please don't forget to accept helpfull answer

How can a service account in active directory sign in to azure with adfs?

Accepted answer

Thameur-BOURBITA 32,606 Reputation points

2024-02-15T13:02:01.88+00:00

Hi @Adi Malyanker

If you want create a service account Cloud only in Entra ID , yu should shoose a non federated domain (xxxx.onmicrosoft.com) to bypass federation redirection for service account authentication:

If the service account is a synced account , it will be redirected to federation service for authentication.

Please don't forget to accept helpfull answer
Please sign in to rate this answer.

1 person found this answer helpful.
Adi Malyanker 65 Reputation points

2024-02-15T13:31:24.74+00:00

I see, so you said that - "If the service account is a synced account, it will be redirected to federation service for authentication." In that case, I guess, he won't be able to log in (because he will have to enter interactively his credentials to the WAP). Am I right?

If I am not right, what authentication method will be used (ADFS + ROPC) ?

Thameur-BOURBITA 32,606 Reputation points

2024-02-15T13:37:29.5133333+00:00

@Adi Malyanker

Yes. From My point of view , if you need a service account to be used on service in Azure you should use a cloud only account. The service account created in on-premise active directory should be used only on on-premise service.

When you create a service account cloud only in Entra ID you should also disable MFA authentication.

Please don't forget to accept helpful answer

Adi Malyanker 65 Reputation points

2024-02-15T13:48:07.7933333+00:00

So, in case that service account is a synced account -> The service account just will try to log in to the adfs login page and get stuck.in case we set it as a cloud user, it signs in as ROPC. Thanks!

Adi Malyanker 65 Reputation points

2024-02-15T14:45:25.2+00:00

So, in case that service account is a synced account -> The service account just will try to log in to the adfs login page and get stuck.in case we set it as a cloud user, it signs in as ROPC.

Thanks!
Sign in to comment

Share via

How can a service account in active directory sign in to azure with adfs?

0 additional answers