Edge 144+ SSO regression with device-bound passkeys in Azure Virtual Desktop

Question

Issue Summary: Microsoft Edge SSO (Single Sign-On) functionality broken after upgrading from version 143 to 144+ in Azure Virtual Desktop environment using device-bound Microsoft Authenticator passkeys.

Environment:

• Azure Virtual Desktop (AVD) session hosts
• FSLogix profile containers for user profile management
• Authentication method: Device-bound Microsoft Authenticator passkeys
• SSO configured for Microsoft 365 and enterprise web applications (SharePoint, ServiceNow, etc.)
• Entra ID joined devices

Working Configuration:

• Microsoft Edge version 143.0.3650.139 and earlier
• User opens Edge and is automatically signed into their Edge profile via SSO
• Navigation to SharePoint, ServiceNow, and other Entra ID-protected resources works seamlessly without manual authentication prompts

Broken Configuration:

• Microsoft Edge version 144.0.3719.82 and later (including 145.0.3800.x)
• User opens Edge and is presented with a "Sign in to Microsoft" prompt instead of automatic SSO
• Edge profile does not automatically sign in
• Unexpected popup appears (e.g., adblock installation prompt), suggesting profile initialisation is not completing correctly
• SSO to Conditional Access-protected resources does not function

Troubleshooting Steps Taken:

1. Version rollback testing:
   • Rolled back Edge from 144 to 143.0.3650.139 - SSO functions correctly
     • Upgraded from 143 directly to 145.0.3800.x - same broken behaviour as 144
       • Confirmed this is a regression introduced in Edge 144
       1. Reviewed known issues:
          • Identified known issue in Edge 144 release notes: "Starting in Microsoft Edge Stable version 144.0.3719.82, users who have not fully completed their Microsoft Entra ID sign-in for their Edge profile may be unable to access Conditional Access (CA) protected web resources, as Single Sign-on (SSO) will not function properly in this degraded sign-in state."
            • Confirmed we are running version 144.0.3719.104 or later where this issue was reportedly fixed, however the fix does not resolve our scenario
            1. Environment specifics:
               • This issue appears specific to the combination of Azure Virtual Desktop, FSLogix profile containers, and device-bound passkey authentication
                 • The passkey authentication method may not be satisfying Edge's new profile sign-in state validation introduced in version 144

Expected Behaviour: Edge should automatically sign in to the user's Entra ID profile using SSO/PRT (Primary Refresh Token) and allow seamless access to Conditional Access-protected resources, as it did in version 143 and earlier.

Actual Behaviour: Edge treats the profile as unsigned or in a degraded sign-in state, prompting manual authentication and breaking SSO to protected web resources.

Business Impact: Users are unable to seamlessly access enterprise web applications in our AVD environment, requiring manual authentication steps that were not previously necessary. We are currently holding Edge at version 143 to maintain functionality, which is not sustainable long-term.

Request: Please investigate whether Edge 144+ has introduced changes to profile sign-in state validation or Windows Authentication Manager integration that affect device-bound passkey authentication scenarios in Azure Virtual Desktop environments.

Answer 1

The issue you are experiencing with Microsoft Edge SSO functionality after upgrading from version 143 to 144+ in an Azure Virtual Desktop environment appears to be related to changes introduced in version 144. Specifically, the known issue noted in the Edge 144 release states that users who have not fully completed their Microsoft Entra ID sign-in for their Edge profile may face difficulties accessing Conditional Access (CA) protected web resources, which aligns with your observation of being prompted for manual authentication instead of seamless SSO.

Given that you have confirmed the issue persists even in version 144.0.3719.104, where the known issue was reportedly fixed, it suggests that there may be additional factors at play, particularly the interaction between Azure Virtual Desktop, FSLogix profile containers, and device-bound passkey authentication. The new profile sign-in state validation introduced in version 144 may not be compatible with your current authentication setup.

To resolve this, it may be beneficial to monitor future updates from Microsoft regarding Edge, as they may address this regression. Additionally, consider reaching out to Microsoft support for further investigation into the specific interaction between Edge 144+ and your Azure Virtual Desktop environment with device-bound passkeys.

---

References:

• Microsoft Edge known issues
• Microsoft Edge release notes for Stable and Extended Stable Channels