Edit

Share via

Set-AzureADApplicationProxyApplicationSingleSignOn

  • Reference
Module:
AzureAD

The Set-AzureADApplicationProxyApplicationSingleSignOn cmdlet allows you to set and modify single sign-on (SSO) settings for an application configured for Application Proxy in Azure Active Directory.

Syntax

Set-AzureADApplicationProxyApplicationSingleSignOn
   -ObjectId <String>
   -SingleSignOnMode <SingleSignOnModeEnum>
   [-KerberosInternalApplicationServicePrincipalName <String>]
   [-KerberosDelegatedLoginIdentity <KerberosSignOnMappingAttributeTypeEnum>]
   [<CommonParameters>]

Description

The Set-AzureADApplicationProxyApplicationSingleSignOn cmdlet allows you to set and modify single sign-on (SSO) settings for an application configured for Application Proxy in Azure Active Directory. This is limited to setting No SSO, Kerberos Constrained Delegation (for applications using Integrated Windows Authentication), and Header-based SSO.

Examples

Example 1

PS C:\> Set-AzureADApplicationProxyApplicationSingleSignOn -ObjectId aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb -SingleSignOnMode OnPremisesKerberos -KerberosInternalApplicationServicePrincipalName "http/www.adventure-works.com" -KerberosDelegatedLoginIdentity OnPremisesUserPrincipalName

Example 1: Assign an application to use Kerberos Constrained Delegation, and specify required parameters.

Example 2

PS C:\> Set-AzureADApplicationProxyApplicationSingleSignOn -ObjectId aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb -SingleSignOnMode None

Example 2: Remove SSO from an application

Parameters

-KerberosDelegatedLoginIdentity

The identity that the Connector can use on behalf of your users to authenticate.

Type:KerberosSignOnMappingAttributeTypeEnum
Accepted values:UserPrincipalName, OnPremisesUserPrincipalName, UserPrincipalUsername, OnPremisesUserPrincipalUsername, OnPremisesSAMAccountName
Position:Named
Default value:None
Required:False
Accept pipeline input:True
Accept wildcard characters:False

-KerberosInternalApplicationServicePrincipalName

The internal application SPN of the application server. This SPN needs to be in the list of services to which the Connector can present delegated credentials.

Type:String
Position:Named
Default value:None
Required:False
Accept pipeline input:True
Accept wildcard characters:False

-ObjectId

The unique application Id of the application that needs different SSO settings. This can be found using the Get-AzureADApplication command. You can also find this in the Azure Portal by navigating to AAD, Enterprise Applications, All Applications, Select your application, go to the properties tab, and use the ObjectId on that page.

Type:String
Position:Named
Default value:None
Required:True
Accept pipeline input:True
Accept wildcard characters:False

-SingleSignOnMode

Choose the type of SSO you would like the application to use. Please note that only three SSO settings are supported in powershell, for more options, please use the Azure Portal.

Type:SingleSignOnModeEnum
Accepted values:None, OnPremisesKerberos, HeaderBased
Position:Named
Default value:None
Required:True
Accept pipeline input:True
Accept wildcard characters:False

Inputs

String

System.Nullable`1[[Microsoft.Open.MSGraph.Model.OnPremisesPublishingSingleSignOnObject+SingleSignOnModeEnum, Microsoft.Open.MS.GraphV10.Client, Version=2.0.0.0, Culture=neutral, PublicKeyToken=null]] System.Nullable`1[[Microsoft.Open.MSGraph.Model.OnPremisesPublishingKerberosSignOnSettingsObject+KerberosSignOnMappingAttributeTypeEnum, Microsoft.Open.MS.GraphV10.Client, Version=2.0.0.0, Culture=neutral, PublicKeyToken=null]]

Outputs

Object