locked
Azure DRS\On-Prem ADFS Workplace Join Doesn't work

    Question

  • Hello,

    I have followed the somewhat nebulous instructions here: https://azure.microsoft.com/en-us/documentation/articles/active-directory-conditional-access-on-premises-setup/

    I have an existing ADFS 3.0 infrastructure, as well as a working synchronization with my on premise AD and Azure\Office 365 via Azure Ad Connect.  ADFS SSO works within Office 365, Exchange Online, OneDrive, etc.  I've seemingly followed this guide to the letter, but I can't get workplace join to work whatsoever with an on-premise account -- though it does work with a cloud-based account.  Using my iPhone as a test, i go to https://enterpriseregistration.windows.net/enrollmentserver/otaprofile/<mydomain> and i'm redirected to our STS sign in.  I sign in, and am told that my credentials are invalid(they aren't) or the connection to my workplace is down, which is possible, but I don't see any other symptoms to suggest that this is true.  

    If I try to join a non domain-joined machine to Azure AD, it goes to the organization single sign on landing page...i sign in, it takes my credentials, and eventually returns with 

    "Something went wrong.  There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code 801c0002."

    This all seems like a pretty raw technology, so there's very little documentation out there.  I'm totally lost on this...can anyone point me in the right direction?  I should add to that I did all of the federation and SSO tests within Azure AD Connect and everything passed without issue, so I believe that portion is working properly...

    Wednesday, June 1, 2016 7:57 PM

All replies

  • Additional note, with debug tracing enabled, I see the following in the event log for ADFS Tracing:

    SSO token is null or empty. Cannot write SSO token to Cookies.

    Thursday, June 2, 2016 7:53 PM
  • Hello,

    Please post here: https://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=ADFS

    This forum is no longer active and will be deactivated soon.

    Thanks! See you on the ADFS forum!


    Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

    Wednesday, June 8, 2016 10:13 PM
    Moderator