I had a lengthy discussion with IBM support about this. The outcome of this was: You can only disable Credential Guard. IBM refuses to do anything to support Credential Guard with Integrated Login.
They failed to even mention the option to switch to CAM. Which we did in the end, and it now works with Credential Guard. If you do not have this option, then there is no solution.
------------------------------
Matthias Mazaj
PM Factory
Vienna
------------------------------
Original Message:
Sent: Fri March 07, 2025 06:43 AM
From: Bernd Siebert
Subject: Windows 11 & Credential Guard breaking TM1 Web / PASS & Integrated Login
Microsoft will end support of Windows 10 in October 2025.
Microsoft recommends to upgrade from Windows 10 to Windows 11.
The problem:
In Windows 11 Credential Guard is enabled by default, breaking Integrated Login when using TM1 Web / Planning Analytics Spreadsheet Services (PASS).
What are the options when the customer
- insists on using Single Sign On (SSO), but refuses to move on from Integrated Login (IntegratedSecurityMode=3) to CAM SSO via IIS (IntegratedSecurityMode=5) , and
- their security policies forbid to disable Credential Guard ?
Links:
1)
https://www.ibm.com/support/pages/users-are-unable-login-tm1-web-or-planning-analytics-spreadsheet-services-windows-10-or-windows-11-using-kerberos-single-sign-when-credential-guard-enabled
Users are unable to login to TM1 Web or Planning Analytics Spreadsheet Services on Windows 10 or Windows 11 using Kerberos Single Sign On when Credential Guard is enabled
2)
https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure?tabs=intune
Learn / Windows / Security /
Configure Credential Guard
------------------------------
Bernd Siebert
------------------------------