This clip discusses some ways of
synchronizing account credentials to
achieve single sign-on. Now, single
sign-on, often referred to by its acronym,
SSO, is an important concept in a world
where cloud services are becoming more
prevalent. In fact, one could say that SSO
is the Holy Grail of computer account
management. One set of credentials to
unlock everything the user needs including
local resources on the domain, resources
in partner organizations such as
applications or databases, cloud-based
resources such as Office 365 or Azure
Active Directory, and password-protected
websites. If we can get to the point where
all such accounts and resources are made
available through a single sign-on, we
might even be able to reduce our sticky
note budget. Now let's explain how SSO
works with different types of account,
starting with a Microsoft account. The
ability to log on to a Windows device,
mobile or not, with a Microsoft email
account started in Windows 8. And you can
still do it today in Windows 10. When you
log on with your Microsoft account,
Windows 10 trusts the authentication and
grants access to the local computer. The
user also gains access to many other
resources without having to log on again,
OneDrive, Mail, Calendar, People,
Synchronized Settings, which we explored
in the previous clip, the online Microsoft
Store, formerly known as the Windows
store, And Office 365 cloud-based
applications. Now by the way, you may have
a Microsoft account even though it was
possibly called something else when you
set it up. If you've ever set up an
account with a Windows Live ID, Microsoft
Passport, Hotmail, Outlook.com, or Xbox
Live then you've got a Microsoft account.
They're free to set up, and they come with
OneDrive storage. How about single sign-on
in the Apple ecosystem? Well, in similar
fashion to the Microsoft account, if you
set up an Apple Touch ID on an iOS phone
or tablet you gain access to the local
device plus your credentials will
authenticate you to the app store, iTunes,
Apple Pay, and iCloud. Note the setup
screen at left where you can configure
which functions you'd like to leverage
your Touch ID and/or passcode with. Google
login provides a similar SSO experience on
Android systems with respect to services
such as Gmail and Google Docs. Now
bouncing back to the Microsoft world for a
bit, we should briefly discuss how
Microsoft suggests organizations achieve
SSO when users need both on-premises
domain accounts and cloud-based Office 365
accounts. Adding an Office 365 user
account adds a user to a cloud-based
Microsoft-provided version of Active
Directory called Azure AD. That user has a
security identifier, or SID, just like a
regular Active Directory domain user.
Azure AD accounts are at first separate
from on-premises Active Directory
accounts. So, I think you can see the
potential for confusion and inconvenience
here if we're going to be asking users at
Globomantics to maintain separate
credentials for their Office 365 access
and their on-premises AD access. In Azure
AD, Microsoft provisions, manages, and
maintains the servers that form the
backbone of the Office 365 user account
infrastructure. So, we can add an Azure AD
account to Windows 10. Now that might make
sense for non-domain-joined devices, for
personal devices in the
bring-your-own-device, or BYOD, scenario.
And what it allows us to do is gain single
sign-on to those Office 365 services,
mail, OneDrive storage, and so forth. Now
at this writing, the way to do this is to
navigate to Settings, Accounts, Access
work or school, and then click Connect.
Provide your Azure AD account credentials
at that point, and this will register your
computer with Azure AD, but it won't join
your computer to Azure AD. So, you can do
this even though you're already on an
Active Directory domain. Now, we can also,
as I just mentioned, join a Windows 10
computer to Azure AD, which is
conceptually similar to joining an
on-premises Active Directory Domain, but
different from adding an Azure AD account
because when we join Azure AD from Windows
10 we can actually log on to Windows 10
with that Azure AD credential, moving us
towards our goal of SSO. So, if you have a
cloud presence, such as Office 365, and no
on-premises Active Directory then joining
Azure AD would be a potentially appealing
choice. You may have a tablet computer
that you'd like to manage and it can't
join an on-premises AD domain, but it can
join Azure AD. So, that would be another
circumstance. And you might have
short-term or seasonal employees, like we
have at Globomantics, who may need access
to resources in the cloud, but don't
necessarily need domain-based management,
given that they're only going to be
working temporarily or seasonally. Even
though AD and Azure AD are two different
account databases, we can connect them,
synchronize them, with a special software
tool from Microsoft. Now, why would we
want to do this? SSO. By linking these
databases, users can automatically
authenticate to both domains with a single
set of credentials. We can sort of set up
a hybrid identity so that we don't have to
ask users who may do some work in the
traditional domain and some work in the
cloud to have to maintain two distinct
sets of usernames and passwords. There's
no need to perform maintenance for these
separate environments. If we connect them,
we can synchronize passwords, computer
accounts, and so forth. So we don't have
to worry about doubling our administrative
overhead. And another benefit of Azure AD
when connected to the on-premises AD is
that we can have settings roaming across
multiple devices, just as we discussed
earlier in this module in connection with
Windows 10 and Microsoft accounts. So,
this has the fancy name of Enterprise
State Roaming, and it's handy because many
organizations don't let users connect to
Microsoft accounts at work. Tech support
doesn't want to have to troubleshoot apps
that users download from the Microsoft
Store. And with that, believe it or not,
we come to the end of this course on
Computer Fundamentals: Mobile Devices.
Thank you for watching, and I invite you
to explore the other classes in the
Computer Fundamentals learning track after
you've given yourself a suitable reward
for having worked your way through this
one. Take care, and I'll see you next time.