Recommended practice to configure transparent authentication with Microsoft Entra ID

Available transparent authentication methods

Internet Access and AI Secure Access support three transparent authentication methods. Which one applies to an endpoint depends on how the endpoint is joined to your directory.

Primary Refresh Token (PRT): For Microsoft Entra ID joined, hybrid joined, or registered devices.
Seamless single sign-on (SSO): For devices that are joined only to your on-premises Active Directory domain.
NTLM or Kerberos single sign-on: For on-premises Active Directory users. This method is configured separately. For more information, see Configure NTLM or Kerberos single sign-on with Active Directory (on-premises).

This topic covers the two Microsoft Entra ID methods. To determine which method applies to an endpoint, run dsregcmd /status on the endpoint and compare the output to the following table.

Device state and applicable transparent authentication method

Device state	`dsregcmd /status` output	Method
Microsoft Entra ID joined	Under Device State: `AzureAdJoined : YES` and `DomainJoined : NO`	PRT. The CloudAP plug-in issues the token automatically during Windows sign-in. No user action is required.
Microsoft Entra ID hybrid joined	Under Device State: `AzureAdJoined : YES` and `DomainJoined : YES`	PRT. The device requires on-premises Active Directory synchronization to Microsoft Entra ID using Microsoft Entra Connect or Microsoft Entra Cloud Sync.
Microsoft Entra ID registered	Under User State: `WorkplaceJoined : YES`	PRT. Typically a personal or BYOD device. The token is issued only after the user manually adds a work account.
Domain-joined only	Under Device State: `DomainJoined : YES` and `AzureAdJoined : NO`. Under User State: `WorkplaceJoined : NO`	Seamless SSO. The endpoint must be able to reach an on-premises domain controller at sign-in time.

Note

A single environment can contain a mix of device states. Configure the Microsoft Entra ID prerequisites for each method that applies to your endpoints.

Supported scenarios

Transparent authentication with Microsoft Entra ID applies only in the following scenarios:

Endpoints with the Secure Access Module installed
Endpoints without the Secure Access Module installed that connect to an on-premises gateway
Endpoints without the Secure Access Module installed that connect to the cloud gateway from a corporate network location identified by preset public IP addresses

For Seamless SSO, the endpoint must also be able to reach your on-premises domain controller at sign-in time in every scenario.

Prepare Microsoft Entra ID for PRT-based transparent authentication

Internet Access or AI Secure Access acts as the service provider that consumes the silent sign-in the endpoint's Web Account Manager (WAM) or Cloud Authentication Provider (CloudAP) broker already produces from a cached PRT. Internet Access or AI Secure Access does not request or manage the token itself, so your environment must first satisfy everything Microsoft Entra ID requires to issue one. For more information, see Understanding Primary Refresh Token (PRT) in Microsoft Entra ID.

Complete and verify all of the following before you configure Internet Access or AI Secure Access.

Run dsregcmd /status on the endpoint and confirm the device state is Microsoft Entra ID joined, hybrid joined, or registered.

Note

For Microsoft Entra ID registered devices, the user must first add a work account by going to Settings → Accounts → Access work or school → Connect, or by accepting the Allow my organization to manage my device prompt. Without this one-time step, no token is issued and the user falls back to interactive sign-in.

In the same dsregcmd /status output, confirm that a token was issued. Under SSO State, check that AzureAdPrt : YES.
Confirm that the browser can retrieve the token from the broker.
- Microsoft Edge: Supported natively.
- Google Chrome: Requires the Windows 10 Accounts extension.
- Mozilla Firefox 91 or later: Requires the Windows SSO setting to be enabled.

Verify that token-based sign-in works without Internet Access or AI Secure Access. In the browser, sign in to a Microsoft first-party page such as https://myaccount.microsoft.com and confirm that no user name or password prompt appears.

Important

If this test fails, resolve the issue before you configure Internet Access or AI Secure Access. For more information, see Troubleshoot primary refresh token issues on Windows devices.

Prepare Microsoft Entra ID and Active Directory for Seamless SSO-based transparent authentication

Internet Access or AI Secure Access acts as the service provider that consumes the sign-in Microsoft Entra ID already produces through Seamless SSO, so your environment must first satisfy everything Seamless SSO requires. For more information, see How Microsoft Entra seamless SSO works.

Complete and verify all of the following before you configure Internet Access or AI Secure Access.

Run dsregcmd /status on the endpoint and confirm that the endpoint is eligible for Seamless SSO: DomainJoined : YES, AzureAdJoined : NO, and, under User State, WorkplaceJoined : NO.

Note

If AzureAdJoined : YES, the device is Microsoft Entra ID hybrid joined and uses PRT instead. If WorkplaceJoined : YES for the signed-in user, that user can also obtain a token through the manually added work account.

Synchronize identities from your on-premises Active Directory to Microsoft Entra ID using either of the following tools:
- Microsoft Entra Connect: See Express installation of Microsoft Entra Connect.
  
  Tip
  
  Microsoft Entra Connect is the simplest option because you can also use it to enable Seamless SSO in the next step.
- Microsoft Entra Cloud Sync: See Install the Microsoft Entra Provisioning Agent and Create a new configuration for Microsoft Entra Cloud Sync.
Enable Seamless SSO using the tool you selected in the previous step.
- Microsoft Entra Connect: Go to Additional tasks → Change user sign-in → Enable single sign-on in the Microsoft Entra Connect wizard, and then enable either pass-through authentication or password hash synchronization. For more information, see Enable Microsoft Entra seamless single sign-on.
- Microsoft Entra Cloud Sync: See How to use single sign-on with Cloud Sync.
Add https://autologon.microsoftazuread-sso.com to the local intranet zone on your endpoints.

Verify that Seamless SSO works without Internet Access or AI Secure Access. In the browser, sign in to a Microsoft first-party page such as https://myaccount.microsoft.com and confirm that no user name or password prompt appears.

Important

If this test fails, resolve the issue before you configure Internet Access or AI Secure Access. For more information, see Microsoft Entra seamless SSO FAQ.

Configure TrendAI Vision One™

The following configuration applies to every endpoint, with or without the Secure Access Module, and is shared by both PRT-based and Seamless SSO-based transparent authentication. Start this configuration only after you verify the Microsoft Entra ID prerequisites for the method that applies to your endpoints.

Configure SAML federation between TrendAI Vision One™ as the service provider and Microsoft Entra ID as the identity provider. For more information, see Configure Microsoft Entra ID.

Add autologon.microsoftazuread-sso.com to the proxy bypass list. If you use a PAC file, add the domain to the bypass list in the PAC file. If you configure the system proxy settings directly, add the domain there.

Note

This domain is required only for Seamless SSO. PRT-based transparent authentication does not use it, but keeping it in the bypass list causes no issues if your endpoints use a mix of both methods.

Confirm that no local user accounts are enabled. Go to Zero Trust Secure Access → Secure Access Configuration → Identity and Access Management, click Local User Account Management, and check the Users tab. For more information, see Local user account management.
Confirm that only one identity provider is enabled. Go to Administration → Identity Providers.

Note

If either a local user account or a second identity provider is enabled, users see an additional Select Authentication Method screen and must manually select Authenticate with identity provider, and the provider to use, before sign-in continues. Authentication still completes automatically after the user selects Microsoft Entra ID, but the flow is no longer fully silent.

Configure the Secure Access Module

The following configuration applies only to endpoints with the Secure Access Module installed.

If the endpoint also uses Private Access, go to Zero Trust Secure Access → Secure Access Configuration → Secure Access Module, click Global Settings, and under Private Access authentication, select Require an additional authentication for users to connect to Private Access while both Private Access and Internet Access and AI Secure Access solutions are enabled.

Select the authentication method on the Windows tab under Global Settings → Authentication method. For more information, see Secure Access Module.

Browser-based authentication: Supported for both PRT-based and Seamless SSO-based transparent authentication. The Secure Access Module opens the default browser to sign in, so the browser can retrieve the token from the WAM or CloudAP broker, or complete Kerberos-based Seamless SSO, the same way a normal browser session does.
Module-based authentication: Supported for Seamless SSO-based transparent authentication only. Module-based authentication cannot obtain a PRT. Endpoints that rely on PRT-based transparent authentication must use browser-based authentication or they fall back to an interactive credential prompt.

Tip

If your environment mixes endpoints that rely on PRT with endpoints that rely on Seamless SSO, select Browser-based authentication, which is the only method compatible with both.

Verify transparent authentication

Before you begin, confirm that the endpoint matches one of the supported scenarios and that the Microsoft Entra ID sign-in test for the applicable method succeeded.

For endpoints without the Secure Access Module installed:

Clear the browser cookies and cache.
Go to any website, such as https://www.example.com.
Confirm that the request completes without a user name or password prompt.

For endpoints with the Secure Access Module installed:

Confirm that you have not used Switch User in the Secure Access Module without restarting the endpoint afterward. Doing so forces a manual sign-in regardless of your configuration.
Sign in using the configured authentication method.
- Browser-based authentication: Open the Secure Access Module and click Sign In. The default browser opens.
- Module-based authentication: Open the Secure Access Module.
Confirm that sign-in completes without a user name or password prompt.

Limitations

Only Internet Access and AI Secure Access support transparent authentication with Microsoft Entra ID.
Only Windows endpoints are supported.
After a user selects Switch User in the Secure Access Module, the module returns the user to the Microsoft Entra ID sign-in screen and does not attempt transparent authentication for the new session. To work around this limitation, restart the endpoint after switching users.
If your organization has a mix of device states, some relying on PRT and others on Seamless SSO, TrendAI™ recommends setting the Secure Access Module Windows authentication method to Browser-based authentication, which is the only method compatible with both.