The Computer Logon Modern Authentication solution consists of many components, including:

  1. Computer Logon Client
  2. Authentication Service
  3. Policy Service
  4. Token Service

The client needs to connect to various services. But how does the client know the address/endpoint of those services?

The answer lies in another service called the Autodiscover Service, which provides the endpoints of those services to the clients in a JSON document. 

Currently, two servers/portals include the Autodiscover Service for Computer Logon MA:

Server/PortalAutodiscover URL
DualShieldhttps://DUALSHIELD-FQDN/sso/v1/computerLogon/check
Computer Logon Management Portalhttps://dn-clo-ma-{entra-tenant-id-without-dash}.azurewebsites.net/api/computerLogon/check

If you are not using the DualShield MFA server, such as Entra MFA, then you need to install the Computer Logon Management Portal in your Entra ID tenant.

Finally, how does the client find the Autodiscover Service URL?

The answer depends on the computer's domain membership. There are 3 types of PCs:

On-Prem AD joined PC

On an on-prem AD joined PC, the logon client queries the on-prem DNS server for a TXT record named "dscloma". The value of the TXT record is the URL of the Autodiscover Service.

References:

Entra ID joined PC

If you have installed the Computer Logon Management Portal in your Entra ID tenant, then the computer logon client on your Entra ID joined PCs will be able to automatically find the Autodiscover Service URL provided by the Management Portal without any further configuration. 

If you do not install the Computer Logon Management Portal, then the logon client queries the Entra DNS service for a TXT record named "dscloma". The value of the TXT record is the URL of the Autodiscover Service.

Hybrid joined PC

Hybrid joined PCs are basically treated the same as On-Prem joined PCs. The logon client queries the on-prem DNS server for a TXT record named "dscloma". The value of the TXT record is the URL of the Autodiscover Service.

References: