Understanding Microsoft Azure AD SSO with non-persistent VDI (Instant Clones)

Let's talk about Azure AD SSO for Microsoft 365 and Office 365 inside of VDI!

In this video, I explore and discuss Azure AD SSO (and the different SSO methods) for Microsoft 365 and Office 365 inside of non-persistent VDI environments. You can use either Azure AD SSO with Primary Refresh Token, or Seamless SSO depending on your requirements and capabilities of configuration.

If your non-persistent VDI VMs don't need to be Hybrid (Azure) AD joined, you can simply exclude the OU from Azure AD Connect, or configure a registry key on your golden image to block Hybrid AD Domain joins, and then enable Seamless SSO.

If you require Azure Hybrid AD Domain joined machines (SSO with Primary Refresh Token), you must configure your environment as per the Microsoft documents (URLs below) provided.

Registry key to block Azure AD Domain Join:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin: "BlockAADWorkplaceJoin"=dword:00000001

And remember, once you figure out how you plan on deploying SSO, you need to enable it via Azure AD Connect (I recommend reading the Microsoft documentation).

Microsoft Links:

To hire me and my company, visit:

#Azure, #AzureAD, #VDI, #SSO, #AzureSSO, #SeamlessSSO, #VMware, #vExpert

[ITSystemsAdmin]

Great tip! Actually we just got these issues in a new VDI deployment with instant clone pools. Thanks.

[LijpeDude]

This is an excellent suggestion! We are running into this issue because we're in the midst of phasing out ADFS and migrating to PTA. Had a lot of issues with the non-persistent machines but this could be the solution! I've seen it before but I thought it only works for down-level Windows devices...thank you!

[davocampo]

Stephen! Question for you - Is there a way to use SSO to sign people into their Work or School accounts in WIn11 automatically? We're trying to build a Win11 gold image to replace Win10. We are using FSLogix to backup profiles and have RoamIdentity turned on. The issue we're facing is its not roaming the work or school account and telling users to verify their account whenever they login to a new VDI session. I just turned RoamIdentity off and am trying to set up Azure AD SSO, but its not signing into work or school accounts automatically and when I log into a new VDI, it throws an error saying the TPM has malfunctioned. - I'm a new SysAdmin, so may have set something up incorrectly. Any help would be greatly appreciated.

[ChrisLuton]

Oh man I've been fighting this for 4 months with Microsoft and Citrix. Definitely going to try your suggestion for SSO on non-persistent legacy AD joined only! Please let me know if anything has changed on this recently Stephen! Thanks!

[ronfisher]

Nice video and just reiterates the nightmare that VDI has become with cloud integration. We are developing a complex stew of Horizon 8 Instant Win10 21H2 clones (testing with hybrid and non hybrid join) along with AAD SSO/MFA o365, Onedrive, fslogix, DEM. The user experience is wrought with password and MFA authentication prompts from one session to the next. MFA tokens are not persisting from one logon to the next. Beyond frustrating.

[DoubleA-ARon]

Hey Stephen, great video and site!
What happens when you have a Azure conditional access policy that is requiring devices be Hybrid AD joined, or Enforce MFA? Every login, every MS app wants a password and MFA prompt, regardless of profile management. Instant clones are not supported by VMware for HAADJ, and the access policy wants HAADJ devices. I know a exception by location in the policy will fix this but that doesn't seem to be an option. I tried the reg entry and excluding the OU from sync, but that's not the issue, it seems the policy is the issue, just not sure how to work around it without changing the policy which will weaken security.