Azure Onpremise Active Directory SSO

Question

Trying to verify a custom domain for single sign in Azure .

We have an onpremise domain controller, its using a non-routable domain (contoso.prod).

Active directory in Azure and on-premise are syncing.

But if I add a custom routable domain contoso.com or contoso.net and check the box "I plan to configure this domain for single sign-on with my local Active Directory ", the domains won't verify for single sign on. Status = "Unverified"

If I don't check that box, I'm able to verify the domain.

Is it because we have a non-routable domain on premise? Do we need to add a UPN suffix?

Please advise.

Answer 1

Checking the box isn't necessary. You can either use AAD Connect to configure SSO, or you can install the Azure AD PowerShell module and run Convert-MsolDomainToFederated on your AD FS server.