How do I automatically log domain users in to Azure DevOps Server 2019?

The auto-login option in Chrome by default depends on the Windows Internet Zone setting. If Azure Devops Server is hosted on a domain that's in the Intranet zone, Chrome should try to automatically sign in.

Internet Explorer should be configured to auto-sign-in on Intranet. You can also add TFS to the Trusted Sites, in which case the default logon settings must be updated to logon for that zone:

There are also a couple of command-line parameters you can add to chrome:

• --auth-negotiate-delegate-whitelist="tfsserver.tld"
• --auth-server-whitelist="tfserver.tld"

See also:

• https://support.pingidentity.com/s/article/How-to-configure-supported-browsers-for-Kerberos-NTLM

I’ve managed to fix the issue on one of my servers. It seems that my Azure DevOps server was seen by Windows as being on the Internet, rather than the Intranet. By changing the Group Policy I was able to get the server to be seen as Intranet. This then causes IE and Chrome to automatically login without ever prompting any users for credentials.

I will need to get my company to push this group policy out to all users, but for my local test, in the Group Policy Editor I went to: User Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page, then select the "Site to Zone Assignment List”, click “Enable” and edit the list by clicking "Show..."

I then added "Value name" = "*.mydomain.org" and "value" = "1".

The 1 is for Intranet. I could also have listed to full server name rather than the full domain.