MyPC EntraID Authentication with Local AD-Entra Sync Clients
In hybrid domain environments where EntraID is in place, but PCs are still joined to a local AD with EntraID sync, MyPC Cloud can function effectively. Here is how:
Prerequisites:
- The UPN in the local AD must match the EntraID UPN.
- Local AD clients must support login with UPN.
- Users must be advised to use UPN when logging into the client.
- Login to MyPC Cloud Web will be via the EntraID login button.
Example Setup:
- Local AD Configuration:
- Domain suffix matches EntraID for example: mypcitsltduk.onmicrosoft.com.
- User added to AD: samAccountName is Presales and UPN is presales@mypcitsltduk.onmicrosoft.com. This UPN matches the EntraID UPN for the user.
- Client PC Setup:
- Install MyPC Cloud EntraID client.
- Configure EntraID Tenant ID on MyPC Cloud service.
- Login Process:
- User logs in with UPN from AD: presales@mypcitsltduk.onmicrosoft.com.
- This logs the user into the local AD.
- MyPC Cloud client for EntraID launches post-login to validate the user.
- UPN is sent to MyPC Cloud Service.
- MyPC Cloud Service uses EntraID integration to verify the user.
- If confirmed, the user is allowed to use the PC.
User Instructions:
- Users should log in to the MyPC Client PC using their UPN.
- On the MyPC Cloud UI, they should use the EntraID login button for Microsoft validation.
- Ideally, users should have the same password for both AD and EntraID.
Why This Works:
- The login request from the client contains the UPN from the login event.
- MyPC Cloud client for EntraID captures the UPN via a Windows system call and sends it to the service.
- The service validates the user with EntraID via the Graph API.
- A true or false message is returned to the client.
- If the user exists, they can use the client PC controlled by MyPC.
- If the user does not exist, they are gracefully logged off.
This setup ensures a seamless and secure authentication process for users in a hybrid domain environment.