From 612d5d7ea0534f4b5450d47b47b4d766961780a1 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Fri, 22 Feb 2019 17:45:03 +0000 Subject: [PATCH] Merged PR 14450: clarification on AAD-join for Surface Hub --- devices/surface-hub/first-run-program-surface-hub.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/devices/surface-hub/first-run-program-surface-hub.md b/devices/surface-hub/first-run-program-surface-hub.md index 6fcee63f5d..346d0c8d8a 100644 --- a/devices/surface-hub/first-run-program-surface-hub.md +++ b/devices/surface-hub/first-run-program-surface-hub.md @@ -335,9 +335,11 @@ This is what happens when you choose an option. - **Use Microsoft Azure Active Directory** - Clicking this option allows you to join the device to Azure AD. Once you click **Next**, the device will restart to apply some settings, and then you’ll be taken to the [Use Microsoft Azure Active Directory](#use-microsoft-azure) page and asked to enter credentials that can allow you to join Azure AD. After joining, admins from the joined organization will be able to use the Settings app. The specific people that will be allowed depends on your Azure AD subscription and how you’ve configured the settings for your Azure AD organization. + Clicking this option allows you to join the device to Azure AD. Once you click **Next**, the device will restart to apply some settings, and then you’ll be taken to the [Use Microsoft Azure Active Directory](#use-microsoft-azure) page and asked to enter credentials that can allow you to join Azure AD. Members of the Azure Global Admins security group from the joined organization will be able to use the Settings app. The specific people that will be allowed depends on your Azure AD subscription and how you’ve configured the settings for your Azure AD organization. >[!IMPORTANT] + >Administrators added to the Azure Global Admins group after you join the device to Azure AD will be unable to use the Settings app. + > >If you join Surface Hub to Azure AD during first-run setup, single sign-on (SSO) for Office apps will not work properly. Users will have to sign in to each Office app individually. - **Use Active Directory Domain Services**