'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How Microsoft Entra Seamless SSO Interacts with Keep Users Signed In
Question details
Understand if Microsoft Entra Seamless SSO still functions when the 'Keep Users Signed In' option is disabled.
- Product
- Microsoft Entra
- Device & OS
- not provided
- Scenario
- Configuring organization sign-in settings and managing persistent browser sessions for corporate users.
- Observed behavior
- Setting the 'Keep Users Signed In' option to 'No' hides the persistent sign-in prompt, raising questions about whether it disrupts automatic SSO authentication on domain-joined devices.
Ensure you have administrator access to the Microsoft Entra admin center to view or modify your organization's company branding and sign-in settings.
Understand the Interaction Between Seamless SSO and KMSI
Learn why disabling the 'Keep Users Signed In' prompt does not affect your Seamless Single Sign-On process on domain-joined devices.
Microsoft Entra Seamless SSO and the 'Keep Users Signed In' (KMSI) option serve two distinct purposes. The KMSI setting determines whether a persistent cookie is issued to keep the browser session active across closures. In contrast, Seamless SSO uses Kerberos tickets to automatically authenticate users in the background.
Setting the 'Show keep user signed in' option to 'No' simply hides the persistent sign-in prompt from the user interface. It does not disable or interfere with the underlying Seamless SSO process.
Ensure your users are logging in from corporate devices joined to your on-premises Active Directory or Microsoft Entra ID, as Seamless SSO relies on this setup.
Observe the sign-in flow on a supported browser. Seamless SSO will continue to automatically pass authentication tokens in the background, bypassing the need for a KMSI persistent cookie.
Switch to WPS Office for a Streamlined Experience
Dealing with complex Microsoft Entra and enterprise sign-in settings can be overwhelming. If you are looking for a reliable, lightweight, and completely free alternative for your document needs, WPS Office offers powerful productivity tools without the administrative overhead.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install the Software: Run the downloaded executable file and follow the straightforward on-screen instructions to install WPS Office.
- 3. Open Your Documents: Launch WPS Office and instantly open your existing Microsoft Word, Excel, and PowerPoint files without any formatting loss.
Frequently Asked Questions
Does turning off 'Keep Users Signed In' sign users out of their active sessions?
No, changing the 'Show keep user signed in' setting to 'No' only prevents the prompt from appearing during new sign-ins. It does not actively revoke or terminate existing persistent sessions that users have already established.
Why do users still see a sign-in prompt with Seamless SSO enabled?
Users might see a prompt if they are using an unsupported browser, if their device is not domain-joined, or if the Intranet zone settings in their browser are not correctly configured to automatically pass Kerberos tickets.
How do I disable the 'Keep Me Signed In' prompt in Microsoft Entra?
You can disable this prompt by navigating to the Microsoft Entra admin center, selecting 'Company branding', editing your default sign-in setup, and setting the 'Show keep user signed in' toggle to 'No'.
