AD FS users will see more login prompts to ensure that the correct user is signed in.

Effective date: December 2021 Endpoints impacted: Integrated Windows Authentication Protocol impacted: Integrated Windows Authentication Change Today, when a user is sent to AD FS to authenticate, they'll be silently signed into any account that already has a session with AD FS. The silent sign-in occurs even if the user intended to sign into a different user account. To reduce the frequency of this incorrect sign-in occurring, starting in December Microsoft Entra ID will send the prompt=login parameter to AD FS if the Web Account Manager in Windows provides Microsoft Entra ID a login_hint during sign-in, which indicates a specific user is desired for sign-in. When the above requirements are met (WAM is used to send the user to Microsoft Entra ID to sign in, a login_hint is included, and the AD FS instance for the user's domain supports prompt=login) the user won't be silently signed in, and instead asked to provide a username to continue signing into AD FS. If they wish to sign into their existing AD FS session, they can select the "Continue as current user" option displayed below the login prompt. Otherwise, they can continue with the username that they intend to sign in with. This change will be rolled out in December 2021 over the course of several weeks. It doesn't change sign in behavior for: Applications that use IWA directly Applications using OAuth Domains that aren't federated to an AD FS instance

Permanent link to this revision