In this article, we shall discuss “Azure Virtual Desktop: Connect to Session Hosts Using Entra ID [Part 04]”. This scenario simulates a common real-world condition where users access Azure Virtual Desktop resources from unmanaged or external devices, requiring specific configuration adjustments to support authentication and connectivity. Please see Azure Virtual Desktop: Deploy host pools and session hosts in the Azure [Part 01], and Manage Azure Virtual Desktop host pools and session hosts using the Azure portal [Part 02].
Verify Azure Virtual Desktop Session Host Functionality from a Windows 11 Client (Entra ID)
In this guide, you will work with an existing Azure Virtual Desktop environment that includes Microsoft Entra ID–joined session hosts. The goal is to validate that these session hosts are functioning correctly by establishing a connection from a Windows 11 client that is not joined to or registered with Microsoft Entra ID.
After completing this lab, you will be able to: Validate the functionality of Microsoft Entra ID–joined Azure Virtual Desktop session hosts by connecting from a non-Entra-joined Windows client: Configure single sign-on for Azure Virtual Desktop using Microsoft Entra ID – Azure Virtual Desktop | Microsoft Learn
Configure RDP Properties for the Azure Virtual Desktop Host Pool
The previously configured RDP settings enable an optimal single sign-on experience, but additional configuration is required for full support. By default, authentication works only if the client is Microsoft Entra joined, hybrid joined, or registered to the same tenant as the session host.
Since the Windows 11 VM does not meet these conditions, the custom RDP property targetisaadjoined:i:1 must be added to the host pool.
On the XXXXX-hp1 RDP Properties page, open the Advanced tab and append the string targetisaadjoined:i:1 to the existing RDP properties. Ensure it is correctly separated from previous entries using a leading semicolon if required.
In the RDP Properties text box, remove the string enablerdsaadauth:i:value if it is present, including its trailing semicolon. In this case, the setting is not present and no action is required.
Please see How to set Up Azure Virtual Desktop Insights Monitoring [Part 03], Disaster Recovery Test Checklist: What to Capture Before You Start, and PCI Driver Error: Connection to Deployment Share could not be made.
Open the Windows App (Remote Desktop Solution
Download App: Windows App – Free download and install on Windows | Microsoft Store
On the Windows 11 taskbar, select the Windows App icon to launch the client application.
Subscribe to an Azure Virtual Desktop Workspace
On the Windows 11 VM, open the Windows App and select Sign in. When prompted, authenticate using the provided credentials and ensure you select the user account that is a member of the Entra group with the AVD-DAG prefix.
In the Devices section, verify that only SessionDesktop is listed and no additional applications or resources are present.
This behavior is expected because the Microsoft Entra user account was previously assigned in the Deploy host pools and session hosts by using the Azure portal (Entra ID) lab to the auto-generated XXXXX-hp1-DAG desktop application group, which results in only SessionDesktop being available under Devices.
On the Windows App page, open the ellipsis (…) menu on the SessionDesktop thumbnail and select Settings from the context menu.
In the SessionDesktop pane, disable the Use default settings toggle switch.
In the Display settings section, select Select displays from the drop-down menu and choose the monitors to use for the session. Then, review the remaining SessionDesktop options, including Maximize to current displays, Single display when in windowed mode, and Fit session to window, without modifying any settings.
In the SessionDesktop pane, review the remaining options such as Maximize to current displays, Single display when in windowed mode, and Fit session to window, ensuring that no changes are made to the default configuration.
Close the SessionDesktop settings pane, then return to the Windows App page and double-click the SessionDesktop icon to launch the remote session.
To enable sign-in to the Windows App session, grant the AVD-DAG group the Virtual Machine User Login role. In a separate browser tab, open the relevant resource group, go to Access control (IAM), and assign the required permissions to the group.
When prompted in the Windows Security dialog, enter the password for the Microsoft Entra user account used to connect to the Azure Virtual Desktop environment.
Azure Virtual Desktop does not support using different accounts for Microsoft Entra sign-in and Windows session sign-in, as this can cause session routing issues and incorrect portal data. After successful authentication, the SessionDesktop window will open automatically.
Remember to use the account that belongs to the group enabled for RDP sessions
In the Windows App session, verify that you have full administrative access (for example, open the Start menu and launch Windows PowerShell (Admin)). Then sign out from the session by selecting the user avatar and choosing Sign out.
After returning to the Windows App, sign out from the client as well. Finally, select Sign In again and authenticate using the credentials of the second Entra ID user account.
Note: Select the Microsoft Entra user account that is a member of the AVD-RemoteApp group. After signing in, confirm that the Windows App page displays four published applications: Command Prompt, Microsoft Word, Microsoft Excel, and Microsoft PowerPoint.
This is expected behavior, as the user account was previously assigned to the XXXXX-hp1-Office365-RAG and XXXX-hp1-Utilities-RAG application groups in the initial lab setup.
When prompted in the Windows Security dialog, enter the password for the second Microsoft Entra user account used to access the Azure Virtual Desktop environment.
Verify that a Command Prompt window opens successfully. In the window, run the hostname command to display the name of the computer hosting the session.
Confirm that the Command Prompt window opens successfully and execute the hostname command. Verify that the returned computer name begins with the sh- prefix, indicating a session host.
In the Command Prompt, run logoff to end the RemoteApp session. Then launch Microsoft Word, Excel, and PowerPoint by double-clicking each icon in the Windows App page, and close each application session window after verification.
This concludes the fourth part of the guide to Azure Virtual Desktop. Let’s now move on to the fifth part for the next steps.
I hope you found this guide on “Azure Virtual Desktop: Connect to Session Hosts Using Entra ID [Part 04]” very useful. Please feel free to leave a comment below.
