Can I connect to an AVD using SSO via Entra External ID?

Question

I am trying to understand if a user invited into an Extra External ID directory will be able to use SSO to access a domain joined Azure Virtual Desktop.

Answer 1

Hello @Sam Price,

Thank you for posting your query on Microsoft Q&A.

To log in to AVD using Microsoft Entra ID accounts, users must be part of the same directory. Currently, users invited through external identities, such as Microsoft Entra Business-to-Business (B2B) or Business-to-Consumer (B2C), are not supported. This is a known limitation.

The reason for this limitation is that in order to log into AVDs using Entra accounts, the virtual machine (VM) must be Azure-joined, specifically Microsoft Entra-joined. Only users created in your tenant can log into Entra-joined machines to achieve Single Sign-On (SSO) behavior. Guest or external accounts cannot log in to these Entra-joined machines, as their accounts are created in a different directory, while the device they are trying to access is enrolled in your directory.

This limitation is by design. For more details, please refer to the following documentation:

Known Limitations of Azure AD Joined Session Hosts

External Identity Authentication for AVD

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,
Raja Pothuraju.

Answer 2

Hello Sam Price

Thanks for your question

Azure Virtual Desktop currently doesn't support external identities.

See: https://learn.microsoft.com/en-us/azure/virtual-desktop/authentication#external-identity

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Abiola

Answer 3

Entra External ID is different to External users, no?