Seamless SSO kerberos encryption update

Question

Seamless SSO kerberos encryption update

Ondrej Kucera 0

Hello Microsoft Support team,

Users are unable to achieve Seamless SSO when accessing cloud applications and are being prompted for passwords. Network traces show that domain controllers are returning KRB_ERR_ETYPE_NOSUPP errors because AES256 encryption is enforced on the Kerberos account. Could you please walk me through how to update the encryption types on the AZUREADSSOACC account so that authentication works properly again ?

Thank you

0 comments

1 answer

Your answer

Answer 1

Hello,

The Seamless SSO failures you are seeing are directly tied to the Kerberos encryption types configured on the special computer account AZUREADSSOACC in Active Directory. When AES256 is enforced but your domain controllers or clients are not aligned to support it consistently, you get the KRB_ERR_ETYPE_NOSUPP error and password prompts instead of silent Kerberos authentication.

The supported way to fix this is to update the encryption type flags on the AZUREADSSOACC account so that AES128 and AES256 are both allowed. Open Active Directory Users and Computers, enable Advanced Features, then locate the AZUREADSSOACC account under the default Computers container. Right‑click, go to Properties, then the Account tab. In the section Account options, you will see checkboxes for “This account supports Kerberos AES 128 bit encryption” and “This account supports Kerberos AES 256 bit encryption.” Make sure both are selected. If only AES256 is checked, Seamless SSO will fail on clients that negotiate AES128.

Alternatively, you can set this via PowerShell on a domain controller:

powershell

Set-ADAccountControl -Identity "AZUREADSSOACC" -KerberosEncryptionType AES128,AES256

This command ensures both AES128 and AES256 are enabled. After applying the change, replicate Active Directory so all domain controllers have the updated account flags. Then flush the Kerberos tickets on a client (klist purge) and retry access to confirm that Seamless SSO succeeds without password prompts.

As a final check, review the domain controller security logs for Event ID 4769 (Kerberos service ticket operations). You should now see successful ticket issuance for the AZUREADSSOACC account with AES128 or AES256 depending on the client capabilities, instead of the KRB_ERR_ETYPE_NOSUPP failures.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.