Merge pull request #220501 from JCoreMS/JCore-AVD-SSOUpdatev2

AVD SSO Updates v2 - Per discussion with DavidB

Author: v-dirichards

articles/virtual-desktop/configure-single-sign-on.md

@@ -7,7 +7,7 @@ manager: femila
 
 ms.service: virtual-desktop
 ms.topic: how-to
-ms.date: 09/22/2022
+ms.date: 12/06/2022
 ms.author: helohr
 ---
 # Configure single sign-on for Azure Virtual Desktop using Azure AD Authentication
@@ -19,7 +19,7 @@ ms.author: helohr
 
 This article will walk you through the process of configuring single sign-on (SSO) using Azure Active Directory (Azure AD) authentication for Azure Virtual Desktop (preview). When you enable SSO, you can use passwordless authentication and third-party Identity Providers that federate with Azure AD to sign in to your Azure Virtual Desktop and Remote Applications.  
 
-For additional passwordless functionality within the session, see the **Next Steps** section for configuring in-session passwordless authentication below.
+For additional passwordless functionality within the session, see the [**Next Steps**](#next-steps) section for configuring in-session passwordless authentication below.
 
 > [!NOTE]
 > Azure Virtual Desktop (classic) doesn't support this feature.
@@ -28,31 +28,29 @@ For additional passwordless functionality within the session, see the **Next Ste
 
 Single sign-on is available on session hosts using the following operating systems:
 
-  - Windows 11 Enterprise single or multi-session with the [2022-09 Cumulative Updates for Windows 11 Preview (KB5017383)](https://support.microsoft.com/kb/KB5017383) or later installed.
-  - Windows 10 Enterprise single or multi-session, versions 20H2 or later with the [2022-09 Cumulative Updates for Windows 10 Preview (KB5017380)](https://support.microsoft.com/kb/KB5017380) or later installed.
-  - Windows Server 2022 with the [2022-09 Cumulative Update for Microsoft server operating system preview (KB5017381)](https://support.microsoft.com/kb/KB5017381) or later installed.
+- Windows 11 Enterprise single or multi-session with the [2022-09 Cumulative Updates for Windows 11 Preview (KB5017383)](https://support.microsoft.com/kb/KB5017383) or later installed.
+- Windows 10 Enterprise single or multi-session, versions 20H2 or later with the [2022-09 Cumulative Updates for Windows 10 Preview (KB5017380)](https://support.microsoft.com/kb/KB5017380) or later installed.
+- Windows Server 2022 with the [2022-09 Cumulative Update for Microsoft server operating system preview (KB5017381)](https://support.microsoft.com/kb/KB5017381) or later installed.
+
+Session hosts must be Azure AD-joined or [Hybrid Azure AD-Joined](https://learn.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan).
 
-Session Hosts must be Azure AD or Hybrid Joined:  
-  - You can enable SSO for connections to Azure Active Directory (AD)-joined VMs. If session hosts need access to SMB shares for FSLogix profiles, you will also need to enable [Kerberos for Azure AD.](../storage/files/storage-files-identity-auth-azure-active-directory-enable.md)  
-  - You can also use SSO to access Hybrid Azure AD-joined VMs, but only after [creating a Kerberos Server object within your Active Directory.](../active-directory/authentication/howto-authentication-passwordless-security-key-on-premises.md#create-a-kerberos-server-object)    
 > [!NOTE]
-> Azure Virtual Desktop doesn't support this solution with VMs joined to Azure AD Domain Services.
+> Azure Virtual Desktop doesn't support this solution with VMs joined to Azure AD Domain Services or Active Directory only joined session hosts.
 
-Connections currently supported:  
-  - [Windows Desktop client](users/connect-windows.md) on local PCs running Windows 10 or later. There's no requirement for the local PC to be joined to a domain or Azure AD. 
-  - [Web client](users/connect-web.md).
+You must [Create a Kerberos Server object](../active-directory/authentication/howto-authentication-passwordless-security-key-on-premises.md#create-a-kerberos-server-object) when your session host is:
 
-> [!IMPORTANT]
-> SSO is currently only supported in the Azure Public cloud.
+- Hybrid Azure AD-joined. Azure AD Kerberos is needed to complete the authentication to the domain controller.
+- Azure AD-joined and your environment contains Active Directory Domain Controllers. Azure AD Kerberos is required in this case for users to access on-premises resources, like SMB shares, and Windows-integrated authentication to websites.
+  
+Clients currently supported:  
 
-## Enable single sign-on
+- [Windows Desktop client](users/connect-windows.md) on local PCs running Windows 10 or later. There's no requirement for the local PC to be joined to a domain or Azure AD.
+- [Web client](users/connect-web.md).
 
-If your host pool contains Hybrid Azure AD-joined session hosts, you must first enable Azure AD Kerberos in your environment by creating a Kerberos Server object. Azure AD Kerberos enables the authentication needed with the domain controller. We recommended you also enable Azure AD Kerberos for Azure AD-joined session hosts if you have a Domain Controller (DC). Azure AD Kerberos provides a single sign-on experience when accessing legacy Kerberos-based applications or network shares. To enable Azure AD Kerberos in your environment, follow the steps to [Create a Kerberos Server object](../active-directory/authentication/howto-authentication-passwordless-security-key-on-premises.md#create-a-kerberos-server-object) on your DC.
+## Enable single sign-on
 
 To enable SSO on your host pool, you must [customize an RDP property](customize-rdp-properties.md). You can find the **Azure AD Authentication** property under the **Connection information** tab in the Azure portal or set the **enablerdsaadauth** property to **1** using PowerShell.
 
-For additional reference: [Deep dive: How Azure AD Kerberos works](https://techcommunity.microsoft.com/t5/itops-talk-blog/deep-dive-how-azure-ad-kerberos-works/ba-p/3070889)
-
 > [!IMPORTANT]
 > If you enable SSO on your Hybrid Azure AD-joined VMs before you create the Kerberos server object, you won't be able to connect to the VMs, and you'll see an error message saying the specific log on session doesn't exist.
 
@@ -63,6 +61,7 @@ When enabling single sign-on, you'll currently be prompted to authenticate to Az
 ## Next steps
 
 - Check out [In-session passwordless authentication (preview)](authentication.md#in-session-passwordless-authentication-preview) to learn how to enable passwordless authentication.
+- For more information about Azure AD Kerberos, see [Deep dive: How Azure AD Kerberos works](https://techcommunity.microsoft.com/t5/itops-talk-blog/deep-dive-how-azure-ad-kerberos-works/ba-p/3070889)
 - If you're accessing Azure Virtual Desktop from our Windows Desktop client, see [Connect with the Windows Desktop client](./users/connect-windows.md).
 - If you're accessing Azure Virtual Desktop from our web client, see [Connect with the web client](./users/connect-web.md).
 - If you encounter any issues, go to [Troubleshoot connections to Azure AD-joined VMs](troubleshoot-azure-ad-connections.md).