[GH-ISSUE #1092] FEATURE REQUEST: Seamless Single Sign-on status and automation #586

New issue

Closed

opened 2026-03-02 12:43:29 +03:00 by kerem · 2 comments

kerem commented

2026-03-02 12:43:29 +03:00

Owner

Originally created by @Nakazen on GitHub (Aug 30, 2022).
Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/1092

Description of the new feature - must be an in-depth explanation of the feature you want, reasoning why, and the added benefits for MSPs as a whole.

Check and show the current state and expiration date of all the Seamless Single Sign-on Kerberos token status in all the connected tenants at a glance.

When you enable Seamless Single Sign-on Microsoft highly recommends that you rollover the kerberos token every 30 days to ensure an adequate level of security.
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-faq#how-can-i-roll-over-the-kerberos-decryption-key-of-the--azureadsso--computer-account-

This means that for every single tenant this needs to be done and monitored separately.
It would be great if this can be monitored in CIPP to make this easier for a MSP to maintain up to date kerberos keys and possibly automate / partially automate this process.
This feature has been requested at Microsoft for multiple years, but no answer from so far. https://feedback.azure.com/d365community/idea/e0b9222b-b525-ec11-b6e6-000d3a4f0789

If you need any more information please let me know.

Originally created by @Nakazen on GitHub (Aug 30, 2022). Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/1092 Description of the new feature - must be an in-depth explanation of the feature you want, reasoning why, and the added benefits for MSPs as a whole. Check and show the current state and expiration date of all the Seamless Single Sign-on Kerberos token status in all the connected tenants at a glance. When you enable Seamless Single Sign-on Microsoft highly recommends that you rollover the kerberos token every 30 days to ensure an adequate level of security. https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-faq#how-can-i-roll-over-the-kerberos-decryption-key-of-the--azureadsso--computer-account- This means that for every single tenant this needs to be done and monitored separately. It would be great if this can be monitored in CIPP to make this easier for a MSP to maintain up to date kerberos keys and possibly automate / partially automate this process. This feature has been requested at Microsoft for multiple years, but no answer from so far. https://feedback.azure.com/d365community/idea/e0b9222b-b525-ec11-b6e6-000d3a4f0789 If you need any more information please let me know.

kerem

2026-03-02 12:43:29 +03:00

closed this issue
added the
enhancement

no-priority
labels

kerem commented

2026-03-02 12:43:30 +03:00

Author

Owner

@KelvinTegelaar commented on GitHub (Sep 1, 2022):

Can;t be done via Partner creds unfortantelly, feel free to remake in a couple of months when everyone is forced to use GDAP, might be possible then!

@KelvinTegelaar commented on GitHub (Sep 1, 2022): Can;t be done via Partner creds unfortantelly, feel free to remake in a couple of months when everyone is forced to use GDAP, might be possible then!

kerem commented

2026-03-02 12:43:30 +03:00

Author

Owner

@Nakazen commented on GitHub (Sep 2, 2022):

Will do, thanks for looking into it!

@Nakazen commented on GitHub (Sep 2, 2022): Will do, thanks for looking into it!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/CIPP#586

No description provided.

Rows
Columns