32 ms·

Does Company ‘X’ have an Azure Active Directory Tenant?

212 points by curiousmindz 4y ago

curiousmindz 4y ago
This is based on a 2017 script that looks up if their domain names are attached to an Azure Active Directory Tenant.
- cassianoleal 4y ago
  But also, what does it say about anything?
  - arkitaip 4y ago
    Microsoft absolutely dominates corporate IT. Their Office 360 delivers to much values at a low cost that the corps suffer from mediocre MS products because it's all there through a single subscription.
    - mc32 4y ago
      Same for the Google options; except the Google options tend to make non-backward compatible changes and often only go 90% of the way to meet the competition in terms of features. Even their spam detection is not where postini had it years ago.
      - jmathai 4y ago
        I worked in Google Workspace. A CIO needs to see significant upside in choosing a non Microsoft solution to take the risk of not going with on-prem /cloud AD. Very few enterprises, this is an understatement, use Workspace exclusively. They need Active Directory Domain Services (on-prem AD) regardless and it is their source of truth (typically syncing to Workdpace for users/roles). The tooling and expertise is in AD. Azure AD will always have a better on-prem to cloud story than Workspace (or any competitor). Plus their licensing makes it a no brainer. It’s a very strong moat.
    - rchaud 4y ago
      With AD we have SSO integration with a whole universe of mediocre apps, Jira for instance
      - hulitu 4y ago
        I need to always give a password in Jira.
        sofixa 4y ago
        Jira, and the whole of Atlassian Cloud services, bundle SSO as a separate service you pay for. It's called Atlassian Access and it costs $4-$2 depending on number of users, so many companies skip it because it easily doubles your Jira/Confluece costs. sso.tax
        realityking 4y ago
        Jira’s cheapest license is $7.5, Atlassian Access as its most expensive is $4 a month. It will never double your Jira bill.
        quickthrower2 4y ago
        Security tax
pid-1 4y ago
Which products are used by large companies that don't have a AAD / AD structure?
- kube-system 4y ago
  On prem AD?
  - jeffmcjunkin 4y ago
    In contrast, the vast majority of companies with Azure AD also have on-prem AD (full name: "Active Directory: Domain Services") with some type of synchronization between them. Usually this amounts to having an on-prem service that shleps password hashes (technically salted, stretched hashed versions of the on-prem hashes) to Azure.
chayesfss 4y ago
I’d bet 100% have tenants but only some with names you know? Why wouldn’t they have a tenant, assess the technology and decide how to incorporate?
- rlv-dan 4y ago
  Exactly. I know one myself, one of the biggest companies in the world, who's tenant name has no resemblance to their company name. Security by obscurity is not a security feature but it is a barrier...
tluyben2 4y ago
I thought it would be 100%; everyone switched to AD after Novell. What are the 16.6% using is the interesting part?
- flatiron 4y ago
  Good question. I’ve worked at apple and google and both like to cook their own implementation. It was AD there.
  - connordoner 4y ago
    Where?
    - flatiron 4y ago
      I guess everywhere. I’ve worked at a ton of “big” companies. All AD. Even the company’s that bake everything themselves. (I’m looking at you apple)
- detaro 4y ago
  Azure Active Directory. On-prem isn't counted. (Also assumptions about the domain used, which might not hold for all)
- jeffmcjunkin 4y ago
  Nearly 100% have on-prem AD (full name: "Active Directory: Domain Services"). Azure AD is a separate identity provider -- to a first approximation it's HTTPS and cookies, not Kerberos, LDAP, and Ticket-Granting Tickets that we see on-prem.
  - trevorishere 4y ago
    > not Kerberos Well... https://techcommunity.microsoft.com/t5/azure-storage-blog/public-preview-leverage-azure-active-directory-kerberos-with/ba-p/3612111 https://techcommunity.microsoft.com/t5/azure-storage-blog/pu... :-)
- 4y ago
vinay_ys 4y ago
The way Microsoft does enterprise price bundling, this is not surprising at all.
- SOLAR_FIELDS 4y ago
  They are insanely good at onboarding people onto it as well. I have a small startup just me and a cofounder right now and we pay $12 a month for 365 which includes all of Azure AD. Can start doing full integrations right away to lock us in.
  - eastbound 4y ago
    This is awesome! I went 6 times to Microsoft AD’s pricing page and I could never figure out how much it would be! Then I remembered it would be bundled with Azure, which, like any cloud, has the “It’s 0.0062$ per unit of consumption, so sometimes it’s 2€ per month, sometimes it’s 647€, we never know ourselves, good luck!” effect. Has anyone else sometimes avoided a cloud service because the pricing was opaque?
    - vinay_ys 4y ago
      They are much nicer in recent years and are quite transparent with pricing – https://www.microsoft.com/en-us/microsoft-365/compare-microsoft-365-enterprise-plans https://www.microsoft.com/en-us/microsoft-365/compare-micros... See full pdf for all plans: https://go.microsoft.com/fwlink/p/?linkid=2139145 https://go.microsoft.com/fwlink/p/?linkid=2139145 Basically if you have a Microsoft Office 365 Enterprise license (E3 or E5 license – which you need if have business people in your company who can't live without Excel on desktop), you get Azure AD Premium (P1 or P2) bundled for free. As I was writing this comment I just went looking at their AD page and found they have launched a new thing called Entra which includes Decentralized ID. And there's a white paper – interesting.
      - logifail 4y ago
        > you get Azure AD Premium (P1 or P2) bundled for free Last time I checked what was included with Azure AD the activity logging data was where it looked like things could get expensive. Exporting your authentication logs and/or keeping them for more than a week was a premium add-on.
idiocrat 4y ago
So many eggs in a basket!
- mrweasel 4y ago
  That’s kinda the point isn’t it. Central management of access to everything.
  - benrow 4y ago
    I initially had the same thought as the parent. From the perspective of so many companies relying on the security of one authentication provider (rather than any one company using AD for all their authentication needs). So if AD were to be compromised, that would be significant impact. There are of course advantages to such a "single point of failure" such as concerted effort in one place. But one way to mitigate the spof is transparency, and I'm reminded of LastPass versus Bitwarden.
- x86_64Ubuntu 4y ago
  They can still have On-Prem failover for domain controllers if Azure has downtime.
unreal37 4y ago
Assuming the #1 Google result on page 1 of search is the companies public domain is a flaw. Some companies use a different domain for corporate use than their public domain name. Like fb.com
- homero 4y ago
  They said that One thing to note about these results is that when we get a result that says the company has a tenant, we are nearly 100% correct in that fact. However, if we say that a company does not have a tenant, we are not necessarily correct. It is possible that the google result did not point to their actual domain name, or they are using a different domain name for their AAD Tenant. If you wanted to do this really robustly, you would probably want to get a better source for your domain names than automated google search results. You might want to also look at other combinations like “companyname.onmicrosoft.com”, however we are doing just rough estimates here.
- Eleison23 4y ago
  Well, you can also spot Facebook when their IPv6 addresses contain :face:b00c:
- ldjb 4y ago
  The script also seems to assume that the company's domain name is of the form (foo.bar), which may be a reasonable assumption for the US-based Fortune 500, but won't work so well if trying to replicate this with international companies (which often have domain names like example.co.uk or example.co.jp).
rootsudo 4y ago
This is assuming the domain has it, but it's even easier actually - you can just DIG DNS records and see if what they run as MX, cnames, etc, if there is teams DNS records and the MX record points to *.onmicrosoft.com or $tenantname.mail.protection.outlook.com there you go, even easier than "querying" google and seeing what's index. And much easier to script too. ;)
- technion 4y ago
  You can also enumerate that tenant and see which businesses share infrastructure/accounts. https://github.com/technion/azure_enum https://github.com/technion/azure_enum
- altdataseller 4y ago
  This shows you which domains uses Microsoft365 though not Azure AD
OrvalWintermute 4y ago
And still, in 2022, we don't have Azure AD replicating the full functionality of an on-premise AD.
- dmarlow 4y ago
  What about coupling AAD with AADDS?
- rejectfinite 4y ago
  What are you missing?
- techwizard81 4y ago
  That's because the goal of AzureAD isn't to replicate on-premise AD
kn8 4y ago
What is Azure AD used for?
- mrweasel 4y ago
  Authorization and authentication. Like it or not Microsoft Active Ditectory or Azure AD (basically the cloud version) works with everything and it’s kinda the only single-signon/shared login solution for enterprises. You can build something yourself with LDAP, Kerberos and maybe Keycloak, but why bother when you more or less need AD for Windows and Exchange anyway.
  - Eduard 4y ago
    Self-hosted Gitlab instances also can act as authentication services. Connecting git with an internal AD/LDAP allows for not requiring Azure AD.
    - jmathai 4y ago
      This isn’t a solution for enterprises, however.
      - eastbound 4y ago
        For juniors: Enterprises and even small startups need to comply with their industry’s security certification (PCI, ISO, whatever) which requires traceability of logins (and central revocation when employees quit and provably complex passwords and inability to retry 100 times, etc.)
    - pdimitar 4y ago
      I'd love to read more about it. Got any links?
      - mutt2016 4y ago
        If it's just SSO, I have many good things to say about keycloak.
not_enoch_wise 4y ago
This is the answer to the question “why can’t we get rid of passwords?”
- wil421 4y ago
  Or you could do the opposite and be like the company I work for. Force everyone to enter an RSA token on every SSO login.
  - Aperocky 4y ago
    It doesn't have to be that manual, yubikey etc can just plug and press.
    - wil421 4y ago
      The company I work for has around 250k employees. I’m sure software RSA is going to be drastically less expensive than yubikey. The people making the policies don’t care at all. They are just dotting is and crossing ts.
  - cratermoon 4y ago
    Unless your company is in a high-risk security-sensitive business, they shouldn't. Most companies can accept the low risk of only requiring a second factor sometimes. Usually time-based, but also looking at location and device fingerprint. For example, if you normally log in from your laptop at work in one state and then it sees you trying to log in from a computer in another state (maybe you're visiting family?) it should definitely challenge you.
- psanford 4y ago
  Nah. Azure AD is one of the few IdPs that already supports FIDO2 Discoverable Credentials. You can use Passkeys with it today. You can go passwordless with it today.
  - tialaramex 4y ago
    Unfortunately, unless this changed too recently for me to know about it, that feature is default off and labelled "Experimental" or something. So it's difficult (ask me how I know) for someone who knows way too much about this stuff and has implemented it themselves, to explain to "leadership" why they should change that default.
sabujp 4y ago
even apple's business manager is compatible with AD
- parkerhiggins 4y ago
  Apple Business Manager added (beta) support for Google Workspace a few months ago.
mberning 4y ago
They have it in some capacity. Most places still have a very significant on-prem or self hosted instance of AD.
- rejectfinite 4y ago
  This, a company/person just needs to sign up for Office 365 and then an Azure AD tenant "exists" for them as the Office 365 are in there.
ascar 4y ago
Why was that title editorialized as "around 83.4%"? 83.4% of 500 is exactly 417. The article is also exact about these numbers. No need to add "around". Edit: Why was the title editorialized to begin with? Edit2: looks like the title was updated to the original. Thanks.
- graiz 4y ago
  The article says that there may be other domains that it didn't catch because it wasn't the first result in google or the company has the server on a different domain, so it's likely a slight undercount.
  - ascar 4y ago
    So "at least" would still have been a more accurate wording.
- darkstar_16 4y ago
  Nit picking much, are we ?
  - ascar 4y ago
    HN Guidelines: "If the title contains a gratuitous number or number + adjective, we'd appreciate it if you'd crop it. E.g. translate "10 Ways To Do X" to "How To Do X," and "14 Amazing Ys" to "Ys." Exception: when the number is meaningful, e.g. "The 5 Platonic Solids." Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize." This is directly against the guidelines and how article titles should be submitted. Editorialization of titles is heavily discouraged and here it even says something the article doesn't. Not at all a nitpick imho.
  - kzrdude 4y ago
    The article could use significant figures better at least. No reason to not say 83% or even "at least 80%" (would be my pick, to reflect the roundness of the number).
- 4y ago
PaulWaldman 4y ago
Microsoft is traditionally great at bundling their products. This is reminiscent of bundling Internet Explorer with Windows. Could an Okta have a claim against Microsoft similar to Netscape in the late 90's?
- ab_testing 4y ago
  Having Azure AD does not prevent clients from also having Okta or any other 2FA provider for 2 factor authentication. In fact, I have worked with at least 10 clients in the last 2 years that used Azure AD for authentication but then something else for 2-factor depending on the type of apps. Sometimes even within one company, there are multiple 2FA protocols, e.g. using Oracle single sign on for ERP apps but Okta for Citrix and other external facing apps.
  - hedora 4y ago
    Okta is a single sign on provider though. Clearly, authenticating via Azure and also Okta would not be single sign on.
    - abruzzi 4y ago
      I don’t know the specific setup, but the app passes you to AAD which passes you to a SAML source (Okta in this instance, but we use Cisco Duo). The SAML provider authenticates you, sets a cookie, then sends you back to AAD, which sets its own cookie, then passes you back to the App. (Or something like that.) if the next app you sign into is an AAD app, you pass through quickly, but if the next app you sign into uses SAML directly you have a cookie set for that as well. We use AAD for O365 and the few apps that won’t use generic SAML, but everything else uses Duo directly. The reason for this is at our O365 license level we don’t get the ability to restrict access to applications by AD group—everyone or we have to manually manage access account by account.
    - trevorishere 4y ago
      I've actually created this setup (in order to ditch Okta as it is far more expensive than AAD P1 if you want MFA). You federate AAD and Okta. Sign in to Okta and it's smooth sailing into AAD-based resources like M365. Okta puts on a good dog and pony show for execs. From a technical perspective, they're no better for corps (at least in first party auth or B2B -- I don't get into the B2C space). We found, for the apps we used, AAD as of ~4 years ago had better SCIM support (!) than Okta. On top of getting O365 E5 + Ent Sec (I think they're just now called M365 E5) which gave us AAD P2 licenses, overall it was much cheaper than Okta. The goal was to just get MFA, which Microsoft gives away for free (with limited toggles) or in P1 licenses (with more toggles) where-as Okta wanted $6/user/month _just for_ MFA. Microsoft puts on a terrible sales pitch, though. We were fortunate enough to have an _awesome_ Principal Program Manager spend days with us in-person answering all of our questions and explaining AAD to our IT management.
bob1029 4y ago
I know how we feel about the Microsoft Death Star consuming all in its path, but there are some upsides to statistics like this. For instance, we are a B2B software vendor in the banking space, and we have to survive all kinds of audits regarding the nature of our code & vendors. By keeping nearly all of our 3rd party items under the Microsoft umbrella, we can automagically skip over vast chunks of our due diligence process (according to the mutual trust equation). None of our customers is F500 (so far), but we have yet to encounter one who didn't already have AAD, or a willingness to set this up. From a product development perspective, we really prefer having a few known-good ways to do things. Authentication & authorization is one area that I strongly dislike having a large variety of flavors on. Especially considering the nature of our business and ever-increasing demands for complex MFA flows (e.g. SAML). There's been so many fly-by-night operations in this space, and our customers do not have patience for trying new things.
- ocdtrekkie 4y ago
  - joebob42 4y ago
    What makes you think you're a potential customer for them?
  - SgtBastard 4y ago
    Are you in the banking space? If not, you aren’t a potential customer.
  - rwalle 4y ago
    Sorry your comment is not helping. You could be working alone or in a 5-people startup and totally have not used anything Microsoft (and your comment does not clarify that), in which case nobody cares whether you want to set up AAD.
ZiiS 4y ago
Bet nearly 100% have a fax machine too.
- b112 4y ago
  Indeed. And a large corp can be using Azure AD, in one little tiny department, spending 100 bucks a month, and it is on list. I bet some of this use is free promo credits.
parkingrift 4y ago
Bundling is anticompetitive and illegal. The MS ecosystem deserves close antitrust scrutiny.
- scarface74 4y ago
  So in that case are the following “illegal” - Apple One - Microsoft Office - Amazon Prime - Google GSuite - Adobe Creative Cloud - Salesforce bundling SFDC with Concur
  - azalemeth 4y ago
    Honestly, I think the regulators should look at basically all of those things. Here in Europe scrutiny is building and a lot of those organisations do party hard and play loose with the rules. Microsoft is famously anticompetitive, but Adobe, Google and Apple can't be far behind in their respective areas.
    - scarface74 4y ago
      Really? So you really think companies shouldn’t be able to sell software that works together bundled together? Why stop there? Phones and computers shouldn’t be “bundled” with operating systems? Computers shouldn’t be “bundled” with sound hardware? Where does it stop?
      - cratermoon 4y ago
        Bundling is fine. Bundling by a company that is a monopoly in the space is (or rather, used to be) a violation of antitrust law. But see Amazon’s Antitrust Paradox, especially sections IIA and IIIB: https://www.yalelawjournal.org/note/amazons-antitrust-paradox https://www.yalelawjournal.org/note/amazons-antitrust-parado...
        scarface74 4y ago
        So in that case, every cable company is a local monopoly and shouldn’t be allowed to bundle channels. Doesn’t anyone see how silly this sounds in 2022? Disney is by far the largest entertainment conglomerate. Should they not be allowed to bundle Hulu, Disney and ESPN? Intel has over 80% of the PC market, how much hardware should they be able to bundle on their motherboard? And HN has a habit of calling any big company a “monopoly”. Amazon only has 56% share of e-commerce and a tiny share of all commerce in the US But getting back to MS Office, I have three “office suites” right now on my phone - all three made by companies worth 1 trillion dollars - Google, Microsoft, and Apple. There is no “monopoly” in the IDP space.
computerfriend 4y ago
I genuinely don't know what AD is used for. If you need SSO, why not just use a SSO/SAML IdP?
- dmarlow 4y ago
  What's the source of data and truth for your SSO?
  - computerfriend 4y ago
    The SSO IdP itself.
- barbazoo 4y ago
  AAD can be used as a SAML IdP. https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/auth-saml https://learn.microsoft.com/en-us/azure/active-directory/fun...
- mnd999 4y ago
  OpenID Connect seems like the current popular flavour. SAML seems to be increasingly considered legacy.
  - cratermoon 4y ago
    Indeed legacy, but you know how Fortune 500 companies are about new technology not directly relevant to their line of business. Also, SAML as a spec is really complex precisely because it was created to satisfy a broad range of Enterprise-y requirements. I don't know if OpenID Connect is there yet. It certainly could be, the underlying spec (oauth2) could support a lot of variant complexity, and OIDC supports mobile and there are lot of extensions available or in progress. https://openid.net/developers/specs/ https://openid.net/developers/specs/
wsjeffro 4y ago
What I can’t understand is why Azure AD doesn’t have a stronger position in the consumer space. Authentication via Google, Apple, and even still Facebook are nearly always supported on customer-facing logins. I rarely see an option for Microsoft. They have a commanding position in the enterprise. What’s keeping them from crossing those enterprise boundaries?
- MattGaiser 4y ago
  Do enough people still use consumer Microsoft accounts? Except for myself, it has been a long time since I have encountered a hotmail address or live address or outlook address in the wild. I've gotten career advice several times to get a GMail instead, because Microsoft was considered out of date and backward (not so much anymore).
  - vladvasiliu 4y ago
    I'd expect this to grow now that Windows pushes more aggressively to use an MS account to login. Plus, if this works as well as it does with the "corporate" AzureAD, it would be a better experience for users. Just "log on with your Windows account". Not saying that's necessarily a good, thing, mind. Only that I expect support to broaden.
  - hedora 4y ago
    Anyone that uses Minecraft (edit: or Xbox) I'm sure it is only a matter of time until some middle manager stakes their promotion on merging it with github and/or linkedin. Microsoft is the only company I deal with where I cannot reliably authenticate. I wish they'd just stop trying to run consumer accounts.
    - easrng 4y ago
      You can link your GitHub account to a Microsoft account and log in to Microsoft with your GitHub account, not sure if you can log in to GitHub with your Microsoft account tho.
  - daveoc64 4y ago
haxxorfreak 4y ago
AADInternals[0] is an excellent set of PowerShell modules for pentesting and performing recon against Azure AD as both an outsider[1] and for someone who has been invited to a tenant. It has similar functionality integrated for discovering if a domain has an associated Azure AD Tenant and enumerating information about users in the tenant, who the "Owner" is and their contact information. As with many Microsoft products there are many configuration options and plenty of them aren't secure by default. [0] https://o365blog.com/aadinternals/ https://o365blog.com/aadinternals/ [1] https://o365blog.com/post/just-looking/ https://o365blog.com/post/just-looking/
dan000892 4y ago
Presumably this is the same thing whatismytenantid.com does under the hood. Interesting (to me) is that the OpenID configuration endpoint provides the tenant ID for not only Commercial tenants but US Government (GCC & GCC-High) as well because the Azure AD portal has relatively new functionality to configure cross-tenant access settings by tenant ID or domain name but Gov tenants require you to obtain the tenant ID from the organization which is either security through obscurity or due to use of some Commercial-only Graph API call.
- tyingq 4y ago
  >Presumably this is the same thing whatismytenantid.com does under the hood. Which is just something like (using slack.com as an example): https://login.microsoftonline.com/slack.com/.well-known/openid-configuration https://login.microsoftonline.com/slack.com/.well-known/open... More urls here: https://o365blog.com/post/just-looking/ https://o365blog.com/post/just-looking/
fweimer 4y ago
Doesn't the end point show up once you have SSO with your own identity provider enabled for any Microsoft services? Maybe technically this means that you have an Active Directory tenant as well, but it doesn't necessarily imply that you are using those Active Directory services for anything beyond that SSO capability. For Google Workspace, a similar URL is: https://www.google.com/a/example.com/ServiceLogin https://www.google.com/a/example.com/ServiceLogin
- hirsin 4y ago
  Yes, it means that you have a tenant in AAD that's usable for signing into SaaS products and Office. May not have many or any users in it, but it exists.
cloudking 4y ago
I wrote a similar script once that took company domain names and then looked up their MX records to see if they were using Google Workspace.
vondur 4y ago
I’m assuming if you were a heavy user of on prem AD, the moving to Azure AD is a logical choice.
sebazzz 4y ago
> We assume the first result is the homepage of that company, and the domain they would use for their tenant. That is a big assumption though. A very well known big-four with two letters uses for instance [letters]gs.com ("Global Services") for instance.
- imron 4y ago
  > However, if we say that a company does not have a tenant, we are not necessarily correct. It is possible that the google result did not point to their actual domain name, or they are using a different domain name for their AAD Tenant
petercooper 4y ago
I know next to nothing about AD, but my company appears to match against this merely because we have an Office 365 account (from which we do nothing except download Word and Excel every now and then) so it doesn't necessarily mean you're using whatever it is much.
- rejectfinite 4y ago
  You dont use it for email/exchange online? All 365 accounts get created in AAD. And your user has access to the portal even. https://aad.portal.azure.com/ https://aad.portal.azure.com/
- flumpcakes 4y ago
  If you have Office 365 you have AAD. If you use pretty much any cloud hosted Microsoft business services, (E# licenses) you are using AAD. If you are using Azure, you are using AAD.
ocdtrekkie 4y ago
So, I don't see anyone pointing it out here: This doesn't mean they use Azure AD! If you use any Microsoft cloud services at all, you get a "shadow tenant". One employee signs into Teams for a meeting once and there you have Azure AD.
altdataseller 4y ago
So Okta (their main conpetitor) uses Azure AD https://login.microsoftonline.com/okta.com/.well-known/openid-configuration https://login.microsoftonline.com/okta.com/.well-known/openi...
- insomniacity 4y ago
  Could easily be for testing/development/research.
- simonw 4y ago
  Apparently so does Google: https://login.microsoftonline.com/google.com/.well-known/openid-configuration https://login.microsoftonline.com/google.com/.well-known/ope...
simonw 4y ago
I never thought about how the "I'm Feeling Lucky" button on Google can double as an API to return the URL of the first search result before. That's pretty neat.
Terretta 4y ago
For the HN B2B startups here supporting Google Workspace SSO and not Microsoft Azure SSO, or offering Sign in with Google and not Sign in with Microsoft... why? 85% of big businesses are on the one you don't support. "Results for the Fortune 500 [to see who's on Azure AD using a] CSV with a list of all the Company Names for all 500 companies. Running it through this script, I find that 417, or 83.4% of companies have AAD, which is just a little off from Microsoft’s public claim of 85%." https://www.shawntabrizi.com/aad/does-company-x-have-an-azure-active-directory-tenant/ https://www.shawntabrizi.com/aad/does-company-x-have-an-azur... See also this top comment: https://news.ycombinator.com/item?id=33046968 https://news.ycombinator.com/item?id=33046968
- matthewaveryusa 4y ago
  azure AD presence does not imply they use msft sso as their sso. sso integration when interacting with a fortune 500 will be a minuscule aspect of the arrangement should you get there. an f500 does not simply decide to use your product and do an sso integration et voila. they want a compliance regiment, a custom crafted legal arrangement, risk assessment, probably an onprem discussion, if you’re small enough a straight out purchase discussion. months if not years of negotiation. basically the sso button is the least of your concerns.
  - Godel_unicode 4y ago
    I hope others listen to this and continue to believe that growing through being a great shadow IT option isn’t viable. Makes my life much easier! If you want to be used by business users in a hurry, be under their p-card limit and support their SSO out of the box.
    - yowlingcat 4y ago
      It sounds like this is exactly a path you have taken with B2B PLG. Mind throwing the rest of us a bone and giving a sense of what your seats/month and/or growth in seats/month looks like?
  - psidebot 4y ago

212 points by curiousmindz 4y ago

curiousmindz 4y ago

This is based on a 2017 script that looks up if their domain names are attached to an Azure Active Directory Tenant.

cassianoleal 4y ago
But also, what does it say about anything?
- arkitaip 4y ago
  Microsoft absolutely dominates corporate IT. Their Office 360 delivers to much values at a low cost that the corps suffer from mediocre MS products because it's all there through a single subscription.
  - mc32 4y ago
    Same for the Google options; except the Google options tend to make non-backward compatible changes and often only go 90% of the way to meet the competition in terms of features. Even their spam detection is not where postini had it years ago.
    - jmathai 4y ago
      I worked in Google Workspace. A CIO needs to see significant upside in choosing a non Microsoft solution to take the risk of not going with on-prem /cloud AD. Very few enterprises, this is an understatement, use Workspace exclusively. They need Active Directory Domain Services (on-prem AD) regardless and it is their source of truth (typically syncing to Workdpace for users/roles). The tooling and expertise is in AD. Azure AD will always have a better on-prem to cloud story than Workspace (or any competitor). Plus their licensing makes it a no brainer. It’s a very strong moat.
  - rchaud 4y ago
    With AD we have SSO integration with a whole universe of mediocre apps, Jira for instance
    - hulitu 4y ago
      I need to always give a password in Jira.
      - sofixa 4y ago
        Jira, and the whole of Atlassian Cloud services, bundle SSO as a separate service you pay for. It's called Atlassian Access and it costs $4-$2 depending on number of users, so many companies skip it because it easily doubles your Jira/Confluece costs. sso.tax
        realityking 4y ago
        Jira’s cheapest license is $7.5, Atlassian Access as its most expensive is $4 a month. It will never double your Jira bill.
        quickthrower2 4y ago
        Security tax

pid-1 4y ago

Which products are used by large companies that don't have a AAD / AD structure?

kube-system 4y ago
On prem AD?
- jeffmcjunkin 4y ago
  In contrast, the vast majority of companies with Azure AD also have on-prem AD (full name: "Active Directory: Domain Services") with some type of synchronization between them. Usually this amounts to having an on-prem service that shleps password hashes (technically salted, stretched hashed versions of the on-prem hashes) to Azure.

chayesfss 4y ago

I’d bet 100% have tenants but only some with names you know? Why wouldn’t they have a tenant, assess the technology and decide how to incorporate?

rlv-dan 4y ago
Exactly. I know one myself, one of the biggest companies in the world, who's tenant name has no resemblance to their company name. Security by obscurity is not a security feature but it is a barrier...

tluyben2 4y ago

I thought it would be 100%; everyone switched to AD after Novell. What are the 16.6% using is the interesting part?

flatiron 4y ago
Good question. I’ve worked at apple and google and both like to cook their own implementation. It was AD there.
- connordoner 4y ago
  Where?
  - flatiron 4y ago
    I guess everywhere. I’ve worked at a ton of “big” companies. All AD. Even the company’s that bake everything themselves. (I’m looking at you apple)
detaro 4y ago
Azure Active Directory. On-prem isn't counted. (Also assumptions about the domain used, which might not hold for all)
jeffmcjunkin 4y ago
Nearly 100% have on-prem AD (full name: "Active Directory: Domain Services"). Azure AD is a separate identity provider -- to a first approximation it's HTTPS and cookies, not Kerberos, LDAP, and Ticket-Granting Tickets that we see on-prem.
- trevorishere 4y ago
  > not Kerberos Well... https://techcommunity.microsoft.com/t5/azure-storage-blog/public-preview-leverage-azure-active-directory-kerberos-with/ba-p/3612111 https://techcommunity.microsoft.com/t5/azure-storage-blog/pu... :-)
4y ago

vinay_ys 4y ago

The way Microsoft does enterprise price bundling, this is not surprising at all.

SOLAR_FIELDS 4y ago
They are insanely good at onboarding people onto it as well. I have a small startup just me and a cofounder right now and we pay $12 a month for 365 which includes all of Azure AD. Can start doing full integrations right away to lock us in.
- eastbound 4y ago
  This is awesome! I went 6 times to Microsoft AD’s pricing page and I could never figure out how much it would be! Then I remembered it would be bundled with Azure, which, like any cloud, has the “It’s 0.0062$ per unit of consumption, so sometimes it’s 2€ per month, sometimes it’s 647€, we never know ourselves, good luck!” effect. Has anyone else sometimes avoided a cloud service because the pricing was opaque?
  - vinay_ys 4y ago
    They are much nicer in recent years and are quite transparent with pricing – https://www.microsoft.com/en-us/microsoft-365/compare-microsoft-365-enterprise-plans https://www.microsoft.com/en-us/microsoft-365/compare-micros... See full pdf for all plans: https://go.microsoft.com/fwlink/p/?linkid=2139145 https://go.microsoft.com/fwlink/p/?linkid=2139145 Basically if you have a Microsoft Office 365 Enterprise license (E3 or E5 license – which you need if have business people in your company who can't live without Excel on desktop), you get Azure AD Premium (P1 or P2) bundled for free. As I was writing this comment I just went looking at their AD page and found they have launched a new thing called Entra which includes Decentralized ID. And there's a white paper – interesting.
    - logifail 4y ago
      > you get Azure AD Premium (P1 or P2) bundled for free Last time I checked what was included with Azure AD the activity logging data was where it looked like things could get expensive. Exporting your authentication logs and/or keeping them for more than a week was a premium add-on.

idiocrat 4y ago

So many eggs in a basket!

mrweasel 4y ago
That’s kinda the point isn’t it. Central management of access to everything.
- benrow 4y ago
  I initially had the same thought as the parent. From the perspective of so many companies relying on the security of one authentication provider (rather than any one company using AD for all their authentication needs). So if AD were to be compromised, that would be significant impact. There are of course advantages to such a "single point of failure" such as concerted effort in one place. But one way to mitigate the spof is transparency, and I'm reminded of LastPass versus Bitwarden.
x86_64Ubuntu 4y ago
They can still have On-Prem failover for domain controllers if Azure has downtime.

unreal37 4y ago

Assuming the #1 Google result on page 1 of search is the companies public domain is a flaw. Some companies use a different domain for corporate use than their public domain name. Like fb.com

homero 4y ago
They said that One thing to note about these results is that when we get a result that says the company has a tenant, we are nearly 100% correct in that fact. However, if we say that a company does not have a tenant, we are not necessarily correct. It is possible that the google result did not point to their actual domain name, or they are using a different domain name for their AAD Tenant. If you wanted to do this really robustly, you would probably want to get a better source for your domain names than automated google search results. You might want to also look at other combinations like “companyname.onmicrosoft.com”, however we are doing just rough estimates here.
Eleison23 4y ago
Well, you can also spot Facebook when their IPv6 addresses contain :face:b00c:
ldjb 4y ago
The script also seems to assume that the company's domain name is of the form (foo.bar), which may be a reasonable assumption for the US-based Fortune 500, but won't work so well if trying to replicate this with international companies (which often have domain names like example.co.uk or example.co.jp).

rootsudo 4y ago

This is assuming the domain has it, but it's even easier actually - you can just DIG DNS records and see if what they run as MX, cnames, etc, if there is teams DNS records and the MX record points to *.onmicrosoft.com or $tenantname.mail.protection.outlook.com there you go, even easier than "querying" google and seeing what's index. And much easier to script too. ;)

technion 4y ago
You can also enumerate that tenant and see which businesses share infrastructure/accounts. https://github.com/technion/azure_enum https://github.com/technion/azure_enum
altdataseller 4y ago
This shows you which domains uses Microsoft365 though not Azure AD

OrvalWintermute 4y ago

And still, in 2022, we don't have Azure AD replicating the full functionality of an on-premise AD.

dmarlow 4y ago
What about coupling AAD with AADDS?
rejectfinite 4y ago
What are you missing?
techwizard81 4y ago
That's because the goal of AzureAD isn't to replicate on-premise AD

kn8 4y ago

What is Azure AD used for?

mrweasel 4y ago
Authorization and authentication. Like it or not Microsoft Active Ditectory or Azure AD (basically the cloud version) works with everything and it’s kinda the only single-signon/shared login solution for enterprises. You can build something yourself with LDAP, Kerberos and maybe Keycloak, but why bother when you more or less need AD for Windows and Exchange anyway.
- Eduard 4y ago
  Self-hosted Gitlab instances also can act as authentication services. Connecting git with an internal AD/LDAP allows for not requiring Azure AD.
  - jmathai 4y ago
    This isn’t a solution for enterprises, however.
    - eastbound 4y ago
      For juniors: Enterprises and even small startups need to comply with their industry’s security certification (PCI, ISO, whatever) which requires traceability of logins (and central revocation when employees quit and provably complex passwords and inability to retry 100 times, etc.)
  - pdimitar 4y ago
    I'd love to read more about it. Got any links?
    - mutt2016 4y ago
      If it's just SSO, I have many good things to say about keycloak.

not_enoch_wise 4y ago

This is the answer to the question “why can’t we get rid of passwords?”

wil421 4y ago
Or you could do the opposite and be like the company I work for. Force everyone to enter an RSA token on every SSO login.
- Aperocky 4y ago
  It doesn't have to be that manual, yubikey etc can just plug and press.
  - wil421 4y ago
    The company I work for has around 250k employees. I’m sure software RSA is going to be drastically less expensive than yubikey. The people making the policies don’t care at all. They are just dotting is and crossing ts.
- cratermoon 4y ago
  Unless your company is in a high-risk security-sensitive business, they shouldn't. Most companies can accept the low risk of only requiring a second factor sometimes. Usually time-based, but also looking at location and device fingerprint. For example, if you normally log in from your laptop at work in one state and then it sees you trying to log in from a computer in another state (maybe you're visiting family?) it should definitely challenge you.
psanford 4y ago
Nah. Azure AD is one of the few IdPs that already supports FIDO2 Discoverable Credentials. You can use Passkeys with it today. You can go passwordless with it today.
- tialaramex 4y ago
  Unfortunately, unless this changed too recently for me to know about it, that feature is default off and labelled "Experimental" or something. So it's difficult (ask me how I know) for someone who knows way too much about this stuff and has implemented it themselves, to explain to "leadership" why they should change that default.

sabujp 4y ago

even apple's business manager is compatible with AD

parkerhiggins 4y ago
Apple Business Manager added (beta) support for Google Workspace a few months ago.

mberning 4y ago

They have it in some capacity. Most places still have a very significant on-prem or self hosted instance of AD.

rejectfinite 4y ago
This, a company/person just needs to sign up for Office 365 and then an Azure AD tenant "exists" for them as the Office 365 are in there.

ascar 4y ago

Why was that title editorialized as "around 83.4%"? 83.4% of 500 is exactly 417. The article is also exact about these numbers. No need to add "around". Edit: Why was the title editorialized to begin with? Edit2: looks like the title was updated to the original. Thanks.

graiz 4y ago
The article says that there may be other domains that it didn't catch because it wasn't the first result in google or the company has the server on a different domain, so it's likely a slight undercount.
- ascar 4y ago
  So "at least" would still have been a more accurate wording.
darkstar_16 4y ago
Nit picking much, are we ?
- ascar 4y ago
  HN Guidelines: "If the title contains a gratuitous number or number + adjective, we'd appreciate it if you'd crop it. E.g. translate "10 Ways To Do X" to "How To Do X," and "14 Amazing Ys" to "Ys." Exception: when the number is meaningful, e.g. "The 5 Platonic Solids." Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize." This is directly against the guidelines and how article titles should be submitted. Editorialization of titles is heavily discouraged and here it even says something the article doesn't. Not at all a nitpick imho.
- kzrdude 4y ago
  The article could use significant figures better at least. No reason to not say 83% or even "at least 80%" (would be my pick, to reflect the roundness of the number).
4y ago

PaulWaldman 4y ago

Microsoft is traditionally great at bundling their products. This is reminiscent of bundling Internet Explorer with Windows. Could an Okta have a claim against Microsoft similar to Netscape in the late 90's?

ab_testing 4y ago
Having Azure AD does not prevent clients from also having Okta or any other 2FA provider for 2 factor authentication. In fact, I have worked with at least 10 clients in the last 2 years that used Azure AD for authentication but then something else for 2-factor depending on the type of apps. Sometimes even within one company, there are multiple 2FA protocols, e.g. using Oracle single sign on for ERP apps but Okta for Citrix and other external facing apps.
- hedora 4y ago
  Okta is a single sign on provider though. Clearly, authenticating via Azure and also Okta would not be single sign on.
  - abruzzi 4y ago
    I don’t know the specific setup, but the app passes you to AAD which passes you to a SAML source (Okta in this instance, but we use Cisco Duo). The SAML provider authenticates you, sets a cookie, then sends you back to AAD, which sets its own cookie, then passes you back to the App. (Or something like that.) if the next app you sign into is an AAD app, you pass through quickly, but if the next app you sign into uses SAML directly you have a cookie set for that as well. We use AAD for O365 and the few apps that won’t use generic SAML, but everything else uses Duo directly. The reason for this is at our O365 license level we don’t get the ability to restrict access to applications by AD group—everyone or we have to manually manage access account by account.
  - trevorishere 4y ago
    I've actually created this setup (in order to ditch Okta as it is far more expensive than AAD P1 if you want MFA). You federate AAD and Okta. Sign in to Okta and it's smooth sailing into AAD-based resources like M365. Okta puts on a good dog and pony show for execs. From a technical perspective, they're no better for corps (at least in first party auth or B2B -- I don't get into the B2C space). We found, for the apps we used, AAD as of ~4 years ago had better SCIM support (!) than Okta. On top of getting O365 E5 + Ent Sec (I think they're just now called M365 E5) which gave us AAD P2 licenses, overall it was much cheaper than Okta. The goal was to just get MFA, which Microsoft gives away for free (with limited toggles) or in P1 licenses (with more toggles) where-as Okta wanted $6/user/month _just for_ MFA. Microsoft puts on a terrible sales pitch, though. We were fortunate enough to have an _awesome_ Principal Program Manager spend days with us in-person answering all of our questions and explaining AAD to our IT management.

bob1029 4y ago

I know how we feel about the Microsoft Death Star consuming all in its path, but there are some upsides to statistics like this. For instance, we are a B2B software vendor in the banking space, and we have to survive all kinds of audits regarding the nature of our code & vendors. By keeping nearly all of our 3rd party items under the Microsoft umbrella, we can automagically skip over vast chunks of our due diligence process (according to the mutual trust equation). None of our customers is F500 (so far), but we have yet to encounter one who didn't already have AAD, or a willingness to set this up. From a product development perspective, we really prefer having a few known-good ways to do things. Authentication & authorization is one area that I strongly dislike having a large variety of flavors on. Especially considering the nature of our business and ever-increasing demands for complex MFA flows (e.g. SAML). There's been so many fly-by-night operations in this space, and our customers do not have patience for trying new things.

ocdtrekkie 4y ago
- joebob42 4y ago
  What makes you think you're a potential customer for them?
- SgtBastard 4y ago
  Are you in the banking space? If not, you aren’t a potential customer.
- rwalle 4y ago
  Sorry your comment is not helping. You could be working alone or in a 5-people startup and totally have not used anything Microsoft (and your comment does not clarify that), in which case nobody cares whether you want to set up AAD.

ZiiS 4y ago

Bet nearly 100% have a fax machine too.

b112 4y ago
Indeed. And a large corp can be using Azure AD, in one little tiny department, spending 100 bucks a month, and it is on list. I bet some of this use is free promo credits.

parkingrift 4y ago

Bundling is anticompetitive and illegal. The MS ecosystem deserves close antitrust scrutiny.

scarface74 4y ago
So in that case are the following “illegal” - Apple One - Microsoft Office - Amazon Prime - Google GSuite - Adobe Creative Cloud - Salesforce bundling SFDC with Concur
- azalemeth 4y ago
  Honestly, I think the regulators should look at basically all of those things. Here in Europe scrutiny is building and a lot of those organisations do party hard and play loose with the rules. Microsoft is famously anticompetitive, but Adobe, Google and Apple can't be far behind in their respective areas.
  - scarface74 4y ago
    Really? So you really think companies shouldn’t be able to sell software that works together bundled together? Why stop there? Phones and computers shouldn’t be “bundled” with operating systems? Computers shouldn’t be “bundled” with sound hardware? Where does it stop?
    - cratermoon 4y ago
      Bundling is fine. Bundling by a company that is a monopoly in the space is (or rather, used to be) a violation of antitrust law. But see Amazon’s Antitrust Paradox, especially sections IIA and IIIB: https://www.yalelawjournal.org/note/amazons-antitrust-paradox https://www.yalelawjournal.org/note/amazons-antitrust-parado...
      - scarface74 4y ago
        So in that case, every cable company is a local monopoly and shouldn’t be allowed to bundle channels. Doesn’t anyone see how silly this sounds in 2022? Disney is by far the largest entertainment conglomerate. Should they not be allowed to bundle Hulu, Disney and ESPN? Intel has over 80% of the PC market, how much hardware should they be able to bundle on their motherboard? And HN has a habit of calling any big company a “monopoly”. Amazon only has 56% share of e-commerce and a tiny share of all commerce in the US But getting back to MS Office, I have three “office suites” right now on my phone - all three made by companies worth 1 trillion dollars - Google, Microsoft, and Apple. There is no “monopoly” in the IDP space.

computerfriend 4y ago

I genuinely don't know what AD is used for. If you need SSO, why not just use a SSO/SAML IdP?

dmarlow 4y ago
What's the source of data and truth for your SSO?
- computerfriend 4y ago
  The SSO IdP itself.
barbazoo 4y ago
AAD can be used as a SAML IdP. https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/auth-saml https://learn.microsoft.com/en-us/azure/active-directory/fun...
mnd999 4y ago
OpenID Connect seems like the current popular flavour. SAML seems to be increasingly considered legacy.
- cratermoon 4y ago
  Indeed legacy, but you know how Fortune 500 companies are about new technology not directly relevant to their line of business. Also, SAML as a spec is really complex precisely because it was created to satisfy a broad range of Enterprise-y requirements. I don't know if OpenID Connect is there yet. It certainly could be, the underlying spec (oauth2) could support a lot of variant complexity, and OIDC supports mobile and there are lot of extensions available or in progress. https://openid.net/developers/specs/ https://openid.net/developers/specs/

wsjeffro 4y ago

What I can’t understand is why Azure AD doesn’t have a stronger position in the consumer space. Authentication via Google, Apple, and even still Facebook are nearly always supported on customer-facing logins. I rarely see an option for Microsoft. They have a commanding position in the enterprise. What’s keeping them from crossing those enterprise boundaries?

MattGaiser 4y ago
Do enough people still use consumer Microsoft accounts? Except for myself, it has been a long time since I have encountered a hotmail address or live address or outlook address in the wild. I've gotten career advice several times to get a GMail instead, because Microsoft was considered out of date and backward (not so much anymore).
- vladvasiliu 4y ago
  I'd expect this to grow now that Windows pushes more aggressively to use an MS account to login. Plus, if this works as well as it does with the "corporate" AzureAD, it would be a better experience for users. Just "log on with your Windows account". Not saying that's necessarily a good, thing, mind. Only that I expect support to broaden.
- hedora 4y ago
  Anyone that uses Minecraft (edit: or Xbox) I'm sure it is only a matter of time until some middle manager stakes their promotion on merging it with github and/or linkedin. Microsoft is the only company I deal with where I cannot reliably authenticate. I wish they'd just stop trying to run consumer accounts.
  - easrng 4y ago
    You can link your GitHub account to a Microsoft account and log in to Microsoft with your GitHub account, not sure if you can log in to GitHub with your Microsoft account tho.
- daveoc64 4y ago

haxxorfreak 4y ago

AADInternals[0] is an excellent set of PowerShell modules for pentesting and performing recon against Azure AD as both an outsider[1] and for someone who has been invited to a tenant. It has similar functionality integrated for discovering if a domain has an associated Azure AD Tenant and enumerating information about users in the tenant, who the "Owner" is and their contact information. As with many Microsoft products there are many configuration options and plenty of them aren't secure by default. [0] https://o365blog.com/aadinternals/ https://o365blog.com/aadinternals/ [1] https://o365blog.com/post/just-looking/ https://o365blog.com/post/just-looking/

dan000892 4y ago

Presumably this is the same thing whatismytenantid.com does under the hood. Interesting (to me) is that the OpenID configuration endpoint provides the tenant ID for not only Commercial tenants but US Government (GCC & GCC-High) as well because the Azure AD portal has relatively new functionality to configure cross-tenant access settings by tenant ID or domain name but Gov tenants require you to obtain the tenant ID from the organization which is either security through obscurity or due to use of some Commercial-only Graph API call.

tyingq 4y ago
>Presumably this is the same thing whatismytenantid.com does under the hood. Which is just something like (using slack.com as an example): https://login.microsoftonline.com/slack.com/.well-known/openid-configuration https://login.microsoftonline.com/slack.com/.well-known/open... More urls here: https://o365blog.com/post/just-looking/ https://o365blog.com/post/just-looking/

fweimer 4y ago

Doesn't the end point show up once you have SSO with your own identity provider enabled for any Microsoft services? Maybe technically this means that you have an Active Directory tenant as well, but it doesn't necessarily imply that you are using those Active Directory services for anything beyond that SSO capability. For Google Workspace, a similar URL is: https://www.google.com/a/example.com/ServiceLogin https://www.google.com/a/example.com/ServiceLogin

hirsin 4y ago
Yes, it means that you have a tenant in AAD that's usable for signing into SaaS products and Office. May not have many or any users in it, but it exists.

cloudking 4y ago

I wrote a similar script once that took company domain names and then looked up their MX records to see if they were using Google Workspace.

vondur 4y ago

I’m assuming if you were a heavy user of on prem AD, the moving to Azure AD is a logical choice.

sebazzz 4y ago

> We assume the first result is the homepage of that company, and the domain they would use for their tenant. That is a big assumption though. A very well known big-four with two letters uses for instance [letters]gs.com ("Global Services") for instance.

imron 4y ago
> However, if we say that a company does not have a tenant, we are not necessarily correct. It is possible that the google result did not point to their actual domain name, or they are using a different domain name for their AAD Tenant

petercooper 4y ago

I know next to nothing about AD, but my company appears to match against this merely because we have an Office 365 account (from which we do nothing except download Word and Excel every now and then) so it doesn't necessarily mean you're using whatever it is much.

rejectfinite 4y ago
You dont use it for email/exchange online? All 365 accounts get created in AAD. And your user has access to the portal even. https://aad.portal.azure.com/ https://aad.portal.azure.com/
flumpcakes 4y ago
If you have Office 365 you have AAD. If you use pretty much any cloud hosted Microsoft business services, (E# licenses) you are using AAD. If you are using Azure, you are using AAD.

ocdtrekkie 4y ago

So, I don't see anyone pointing it out here: This doesn't mean they use Azure AD! If you use any Microsoft cloud services at all, you get a "shadow tenant". One employee signs into Teams for a meeting once and there you have Azure AD.

altdataseller 4y ago

So Okta (their main conpetitor) uses Azure AD https://login.microsoftonline.com/okta.com/.well-known/openid-configuration https://login.microsoftonline.com/okta.com/.well-known/openi...

insomniacity 4y ago
Could easily be for testing/development/research.
simonw 4y ago
Apparently so does Google: https://login.microsoftonline.com/google.com/.well-known/openid-configuration https://login.microsoftonline.com/google.com/.well-known/ope...

simonw 4y ago

I never thought about how the "I'm Feeling Lucky" button on Google can double as an API to return the URL of the first search result before. That's pretty neat.

Terretta 4y ago

For the HN B2B startups here supporting Google Workspace SSO and not Microsoft Azure SSO, or offering Sign in with Google and not Sign in with Microsoft... why? 85% of big businesses are on the one you don't support. "Results for the Fortune 500 [to see who's on Azure AD using a] CSV with a list of all the Company Names for all 500 companies. Running it through this script, I find that 417, or 83.4% of companies have AAD, which is just a little off from Microsoft’s public claim of 85%." https://www.shawntabrizi.com/aad/does-company-x-have-an-azure-active-directory-tenant/ https://www.shawntabrizi.com/aad/does-company-x-have-an-azur... See also this top comment: https://news.ycombinator.com/item?id=33046968 https://news.ycombinator.com/item?id=33046968

matthewaveryusa 4y ago
azure AD presence does not imply they use msft sso as their sso. sso integration when interacting with a fortune 500 will be a minuscule aspect of the arrangement should you get there. an f500 does not simply decide to use your product and do an sso integration et voila. they want a compliance regiment, a custom crafted legal arrangement, risk assessment, probably an onprem discussion, if you’re small enough a straight out purchase discussion. months if not years of negotiation. basically the sso button is the least of your concerns.
- Godel_unicode 4y ago
  I hope others listen to this and continue to believe that growing through being a great shadow IT option isn’t viable. Makes my life much easier! If you want to be used by business users in a hurry, be under their p-card limit and support their SSO out of the box.
  - yowlingcat 4y ago
    It sounds like this is exactly a path you have taken with B2B PLG. Mind throwing the rest of us a bone and giving a sense of what your seats/month and/or growth in seats/month looks like?
- psidebot 4y ago