mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
updates
This commit is contained in:
Paolo Matarazzo
parent
a129e21347
commit
7610bda435
111
education/windows/federated-sign-in.md
Normal file
111
education/windows/federated-sign-in.md
Normal file
@ -0,0 +1,111 @@
|
||||
---
|
||||
title: Configure federated sign-in for Windows devices
|
||||
description: Description of federated sign-in feature for Windows 11 SE and how to configure it via Intune
|
||||
ms.date: 09/15/2022
|
||||
ms.prod: windows
|
||||
ms.technology: windows
|
||||
ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.reviewer:
|
||||
manager: aaroncz
|
||||
ms.collection: education
|
||||
appliesto:
|
||||
- ✅ <b>Windows 11 SE 22H2</b>
|
||||
---
|
||||
|
||||
<!-- MAXADO-6286399 -->
|
||||
# Configure federated sign-in for Windows 11 SE
|
||||
|
||||
Starting in **Windows 11 SE, version 22H2**, you can enable your users to sign-in using a third-party identity provider (IdP). This feature is called **federated sign-in**. Federated sign-in is a great way to simplify the sign-in process for your users. Instead of having to remember a username and password, they can sign-in using their existing credentials from their IdP. For example, students and educators can use picture passwords or QR code badges to sign-in.
|
||||
|
||||
## Benefits of federated sign-in
|
||||
|
||||
With federated sign-in, students can sign-in in less time, and with less friction.
|
||||
Fewer credentials to remember and a simplified sign-in process, enable students to be more engaged and focused on learning.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
To implement federated sign-in, the following prerequisites must be met:
|
||||
|
||||
1. An Azure AD tenant, with one or multiple domains federated to a third-party IdP. For more information, see [Use a SAML 2.0 Identity Provider (IdP) for Single Sign On][AZ-1]
|
||||
1. Individual IdP accounts created: each user will require an account defined in the third-party IdP platform
|
||||
1. Individual Azure AD accounts created: each user will require a matching account defined in Azure AD. These accounts are commonly created through automation, with a provisioning process offered by the IdP
|
||||
1. Licenses assigned to the Azure AD user accounts. It's recommended to assign licenses to a dynamic group: when new users are provisioned in Azure AD, the licenses are automatically assigned. For more information, see [Assign licenses to users by group membership in Azure Active Directory][AZ-2]
|
||||
1. Enable federated sign-in on the Windows devices that the users will be using
|
||||
> [!IMPORTANT]
|
||||
> This feature is exclusively available for Windows 11 SE, version 22H2.
|
||||
1. The Windows devices must have *shared PC mode* disabled
|
||||
|
||||
## Enable federated sign-in on devices
|
||||
|
||||
Before you can sign-in with a federated IdP, your devices must be configured with different policies. Follow the instructions below to configure your devices using either Microsoft Intune or a provisioning package (PPKG).
|
||||
|
||||
#### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune)
|
||||
|
||||
To configure federated sign-in using Microsoft Intune, [create a custom profile][MEM-1] with the following settings:
|
||||
|
||||
| Setting |
|
||||
|--------|
|
||||
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/FederatedAuthentication/EnableWebSignInForPrimaryUser`** </li><li>Data type: **Integer** </li><li>Value: **1**</li>|
|
||||
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebSignInAllowedUrls`** </li><li>Data type: **String** </li><li>Value: Semicolon separated list of domains, for example: **`samlidp.clever.com;clever.com;mobile-redirector.clever.com`**</li>|
|
||||
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/Education/IsEducationEnvironment`** </li><li>Data type: **Integer** </li><li>Value: **1**</li>|
|
||||
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebCamAccessDomainNames`** </li><li>Data type: **String** </li><li>Value: This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that re llowed to use the webcam during the sign-in process, separated by a semicolon. For example: **`clever.com`**</li>|
|
||||
| <li> OMA-URI: **`./Vendor/MSFT/SharedPC/EnableSharedPCMode`** </li><li>Data type: **Boolean** </li><li>Value: **False**</li>|
|
||||
|
||||
:::image type="content" source="images/federated-authentication-settings-intune.png" alt-text="Custom policy showing the settings to be configured to enable federated sign-in" lightbox="images/edu-federated-authentication-settings.png" border="true":::
|
||||
|
||||
Assign the policy to a security group that contains as members the devices that require federated sign-in.
|
||||
|
||||
#### [:::image type="icon" source="images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg)
|
||||
|
||||
To configure federated sign-in using a provisioning package, use the following settings:
|
||||
|
||||
| Setting |
|
||||
|--------|
|
||||
| <li> Path: **`FederatedAuthentication/EnableWebSignInForPrimaryUser`** </li><li>Value: **Enabled**</li>|
|
||||
| <li> Path: **`Policies/Authentication/ConfigureWebSignInAllowedUrls`** </li><li>Value: Semicolon separated list of domains, for example: **`samlidp.clever.com;clever.com;mobile-redirector.clever.com`**</li>|
|
||||
| <li> Path: **`Policies/Education/IsEducationEnvironment`** </li><li>Data type: **Integer** </li><li>Value: **1**</li>|
|
||||
| <li> Path: **`Policies/Authentication/ConfigureWebCamAccessDomainNames`** </li><li>Value: This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during he sign-in process, separated by a semicolon. For example: **`clever.com`**</li>|
|
||||
| <li> Path: **`SharedPC/EnableSharedPCMode`** </li><li>Value: **False**</li>|
|
||||
|
||||
:::image type="content" source="images/federated-authentication-settings-ppkg.png" alt-text="Custom policy showing the settings to be configured to enable federated sign-in" lightbox="images/edu-federated-authentication-settings.png" border="true":::
|
||||
|
||||
Apply the provisioning package to the devices that require federated sign-in.
|
||||
|
||||
#### [:::image type="icon" source="images/icons/group-policy.svg"::: **GPO**](#tab/gpo)
|
||||
|
||||
This setting is not available in Group Policy.
|
||||
|
||||
---
|
||||
|
||||
## How to use federated sign-in
|
||||
|
||||
Once the devices are configured, a new sign-in experience becomes available.
|
||||
|
||||
As the end users enters their username, they will be redirected to the IdP sign-in page. Once the user is authenticated, they will be redirected back to the device, and the user will be signed-in.
|
||||
|
||||
:::image type="content" source="./images/federated-sign-in.gif" alt-text="Windows 11 SE sign-in using federated sign-in through Clever and QR code badge." border="true":::
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Once the policy is enabled, the first user to sign-in to the device will also set the disambiguation page to the identity provider domain on the device. This means that the device will be defaulting to that IdP. The user can exit the federated sign-in flow by pressing <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>Delete</kbd> to get back to the standard Windows sign-in screen.
|
||||
|
||||
## Known issues
|
||||
|
||||
- Network and Accessibility menus aren't available in the web sign-in flow. They can be accessed on the standard Windows sign-in page. While in the web sign-in flow, press <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>Delete</kbd> and the classic Windows sign-in UI will be shown, along with the buttons that launch those menus.
|
||||
- This feature won't work without access to network, as the authentication is done via a third-party provider over the network. Always make sure that there's a valid network connection, before trying to launch the web sign-in flow.
|
||||
- The federated sign-in flow is not displayed if devices have *shared PC mode* enabled
|
||||
- It is not supported to configure the *Azure AD preferred tenant name* feature with federated sign-in
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
- The user can exit the federated sign-in flow by pressing <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>Delete</kbd> to get back to the standard Windows sign-in screen
|
||||
- Select the *Other User* button, and the standard username/password credentials are available to log into the device
|
||||
|
||||
-----------
|
||||
|
||||
[MEM-1]: /mem/intune/configuration/custom-settings-windows-10
|
||||
|
||||
[AZ-1]: /azure/active-directory/hybrid/how-to-connect-fed-saml-idp
|
||||
[AZ-2]: /azure/active-directory/enterprise-users/licensing-groups-assign
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 124 KiB |
@ -51,6 +51,12 @@ sections:
|
||||
answer: |
|
||||
The IT Admins at your school manage system settings (including application installation and the application store) to ensure all students have a safe, distraction-free experience. On your device you'll have pre-installed apps from Microsoft, from your IT admin, and from your device manufacturer. You can continue to use web apps on the Microsoft Edge browser, as web apps do not require installation.
|
||||
To learn more, go to the [][].
|
||||
- question: Why do I get 0x87D300D9 error code with a `Failed` state in Intune?
|
||||
answer: |
|
||||
If you have an app that fails with this error, then:
|
||||
- Make sure the app is on the [available applications list](#available-applications). Or, make sure your app is [approved for Windows 11 SE](#add-your-own-applications)
|
||||
- If the app is approved, then it's possible the app is packaged wrong. For more information, see [Add your own apps](#add-your-own-applications) and [Configure applications with Microsoft Intune][EDUWIN-1]
|
||||
- If the app isn't approved, then it won't run on Windows 11 SE. To get apps approved, see [Add your own apps](#add-your-own-applications). Or, use an app that runs in a web browser, such as a web app or PWA
|
||||
- name: Out-of-box experience (OOBE)
|
||||
questions:
|
||||
- question: My Windows 11 SE device is stuck in OOBE, how can I troubleshoot it?
|
||||
|
||||
@ -166,55 +166,6 @@ When the app is ready, Microsoft will update you. Then, you add the app to the I
|
||||
|
||||
For more information on Intune requirements for adding education apps, see [Configure applications with Microsoft Intune][EDUWIN-1].
|
||||
|
||||
### 0x87D300D9 error with an app
|
||||
|
||||
When you deploy an app using Intune for Education, you may get a `0x87D300D9` error code with a `Failed` state in the [Intune for Education portal](https://intuneeducation.portal.azure.com). If you have an app that fails with this error, then:
|
||||
|
||||
- Make sure the app is on the [available applications list](#available-applications). Or, make sure your app is [approved for Windows 11 SE](#add-your-own-applications)
|
||||
- If the app is approved, then it's possible the app is packaged wrong. For more information, see [Add your own apps](#add-your-own-applications) and [Configure applications with Microsoft Intune][EDUWIN-1]
|
||||
- If the app isn't approved, then it won't run on Windows 11 SE. To get apps approved, see [Add your own apps](#add-your-own-applications). Or, use an app that runs in a web browser, such as a web app or PWA
|
||||
|
||||
## Enable federated sign-in on devices
|
||||
|
||||
Before you can sign-in with a federated IdP, your devices must be configured with different policies. Follow the instructions below to configure your devices using either Microsoft Intune or a provisioning package (PPKG).
|
||||
|
||||
#### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune)
|
||||
|
||||
To configure federated sign-in using Microsoft Intune, [create a custom profile][MEM-1] with the following settings:
|
||||
|
||||
| Setting |
|
||||
|--------|
|
||||
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/FederatedAuthentication/EnableWebSignInForPrimaryUser`** </li><li>Data type: **Integer** </li><li>Value: **1**</li>|
|
||||
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebSignInAllowedUrls`** </li><li>Data type: **String** </li><li>Value: Semicolon separated list of domains, for example: **`samlidp.clever.com;clever.com;mobile-redirector.clever.com`**</li>|
|
||||
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/Education/IsEducationEnvironment`** </li><li>Data type: **Integer** </li><li>Value: **1**</li>|
|
||||
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebCamAccessDomainNames`** </li><li>Data type: **String** </li><li>Value: This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that re llowed to use the webcam during the sign-in process, separated by a semicolon. For example: **`clever.com`**</li>|
|
||||
| <li> OMA-URI: **`./Vendor/MSFT/SharedPC/EnableSharedPCMode`** </li><li>Data type: **Boolean** </li><li>Value: **False**</li>|
|
||||
:::image type="content" source="images/edu-federated-authentication-settings-intune.png" alt-text="Custom policy showing the settings to be configured to enable federated sign-in" lightbox="images/edu-federated-authentication-settings.png" border="true":::
|
||||
|
||||
Assign the custom policy to the security groups that require federated sign-in.
|
||||
|
||||
#### [:::image type="icon" source="images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg)
|
||||
|
||||
To configure federated sign-in using a provisioning package, use the following settings:
|
||||
|
||||
| Setting |
|
||||
|--------|
|
||||
| <li> Path: **`FederatedAuthentication/EnableWebSignInForPrimaryUser`** </li><li>Value: **Enabled**</li>|
|
||||
| <li> Path: **`Policies/Authentication/ConfigureWebSignInAllowedUrls`** </li><li>Value: Semicolon separated list of domains, for example: **`samlidp.clever.com;clever.com;mobile-redirector.clever.com`**</li>|
|
||||
| <li> Path: **`Policies/Education/IsEducationEnvironment`** </li><li>Data type: **Integer** </li><li>Value: **1**</li>|
|
||||
| <li> Path: **`Policies/Authentication/ConfigureWebCamAccessDomainNames`** </li><li>Value: This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during he sign-in process, separated by a semicolon. For example: **`clever.com`**</li>|
|
||||
| <li> Path: **`SharedPC/EnableSharedPCMode`** </li><li>Value: **False**</li>|
|
||||
|
||||
:::image type="content" source="images/edu-federated-authentication-settings-ppkg.png" alt-text="Custom policy showing the settings to be configured to enable federated sign-in" lightbox="images/edu-federated-authentication-settings.png" border="true":::
|
||||
|
||||
Apply the provisioning package to the devices that require federated sign-in.
|
||||
|
||||
#### [:::image type="icon" source="images/icons/group-policy.svg"::: **GPO**](#tab/gpo)
|
||||
|
||||
This setting is not available in Group Policy.
|
||||
|
||||
---
|
||||
|
||||
## Related articles
|
||||
|
||||
- [Tutorial: deploy and manage Windows devices in a school][EDUWIN-2]
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user