Get-AzureAdSsoSpnCandidate

Business value: This command provides visibility into the Azure AD Seamless SSO configuration, helping administrators ensure seamless single sign-on is properly set up and maintained. Who uses this: System Administrators responsible for managing Azure AD and Windows Server environments. Risks: Inaccurate or outdated SPN configurations can lead to authentication issues, impacting user productivity. Non-existent AZUREADSSOACC$ account in AD indicates that Seamless SSO is not enabled (GR-535). When a manager cares: * When users report authentication issues * During routine security audits and compliance checks

Day-to-Day Use

1. Run Get-AzureAdSsoSpnCandidate to retrieve the AZUREADSSOACC$ computer account SPNs and password age.
2. Review the output for RegisteredSpns, PwdLastSet, PasswordAgeDays, and RotationOverdue values.

(Get-AzureAdSsoSpnCandidate).RegisteredSpns

Code Examples

• Get AZUREADSSOACC$ account SPNs: (Get-AzureAdSsoSpnCandidate).RegisteredSpns
• Check password age in days: (Get-AzureAdSsoSpnCandidate).PasswordAgeDays
• Determine rotation overdue status: (Get-AzureAdSsoSpnCandidate).RotationOverdue

Watchpoints

• Be cautious when interpreting results, as Azure AD Connect manages the AZUREADSSOACC$ account and its SPNs automatically.
• No write path exists for this command; it only provides read-only information.

What It Does

This command reads the AZUREADSSOACC$ computer object from Active Directory to determine: * Registered SPNs on the account * Password last-set timestamp (UTC) * Age of password in days (computed at call time)

Step-by-Step Recipe

1. Run Get-AzureAdSsoSpnCandidate to retrieve AZUREADSSOACC$ account information.
2. Check if RegisteredSpns, PwdLastSet, PasswordAgeDays, and RotationOverdue values are present.

Stuck?

• Consult the PowerShell module wiki for more detailed documentation.
• Reach out to your system administrator or Azure AD support team for assistance.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

This command adheres to standard PowerShell module best practices for data handling: * Data is retrieved from Active Directory using native cmdlets. * Transit: data is encrypted during transmission. * At-rest: data is stored securely on local system. Audit trail: no changes are made, so no audit trail required.