Azure AD Seamless SSO - Prompts on Connecting to aadg.windows.net.nsatc.net

At a customer site when attempting to access the https://myapps.microsoft.com/companydomain.com portal to test Single Sign-on with Azure AD, we were constantly being prompted "Connecting to aadg.windows.net.nsatc.net".

 

We had gone through significant troubleshooting on the issue but could not find a resolution online.  This troubleshooting included but was not limited to:

• Confirmed that we have received the Kerberos ticket from the AZUREADSSOACC with “klist get AZUREADSSOACC”
• Added https://autologon.microsoftazuread-sso.com and https://aadg.windows.net.nsatc.net to the Trusted Sites
• Confirmed the servicePrincipalNames on the AZUREADSSOACC are correct
• Validated the Single sign-on is enabled on the Azure AD Portal and in the Azure AD Connect tool

Troubleshooting sites we went through included:

http://tiftomorrow.blogspot.com/2017/10/azure-ad-sso-troubleshooting.html

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/tshoot-connect-sso

After speaking with Microsoft, they mentioned that "https://autologon.microsoftazuread-sso.com" must also be in the "Local Intranet" zone.

 

  

This is due to the default security setting "Automatic logon only in Intranet zone".  If this was set to "Automatic logon with current user name and password" this would have also fixed the issue but is not as secure.

 

 

After making this change Single Sign-On works.