active-directoryazureazure-active-directorysingle-sign-on
Within the Azure portal, inside an Active Tenant I have an application with users listed, of which are created in the tenant.
What does the term Assigned mean?
I incorrectly assumed that it meant the user existed in the Azure tenant, but could not access the application. However, this cannot be true because I can successfully log in as a user who is not assigned:
Can anyone offer an explanation please in the absence of a help file (nudge nudge Microsoft!)?
It may be that the account is both a valid Microsoft Account (formerly Live ID) AND a valid Organisational Account (Azure AD). This can happen (you have a Live ID for years then your company signs up for Office 365) and leads to all sorts of fun and games because 'home realm discovery' defaults to Azure AD.
In the first login box provided by Azure try typing any address with an '@outlook.com' address - you will be redirected to the Outlook login page (which uses Live IDs). On the Outlook login page enter your 'david@mycompany.co.uk' email and password. I expect you'll login.
I talk about the background (and reason) for this scenario on my blog.
Basically I have missed 2 steps. Apart from above settings in the question itself,
(1)Self service password reset should be turned on.
and from onpremis integration "write back passwords to onprmises directory" should be enabled.
and also this needs azure p2 or similar license and besides when a user loggs in it will ask to provide mobile/and different email.
Users themselves can reset password now and Passwordwrite works and sync works as expected.
Best Answer
That field is most likely being used to track licensing or plans from Microsoft / other SaaS solutions. Do the other users you have who have 'Yes' next to their name use something like Azure AD Premium, Office 365 or access to one of the Apps in the Azure AD SSO-supported list?