Skip to content

Commit f8824c4

Browse files
davidbeldavidbel
committed
Work in progress
1 parent 361ce6e commit f8824c4

File tree

1 file changed

+164
-6
lines changed

1 file changed

+164
-6
lines changed

‎articles/virtual-desktop/configure-single-sign-on.md

Lines changed: 164 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Learn how to configure single sign-on for an Azure Virtual Desktop
44
ms.topic: how-to
55
author: dknappettmsft
66
ms.author: daknappe
7-
ms.date: 12/15/2023
7+
ms.date: 08/27/2024
88
---
99

1010
# Configure single sign-on for Azure Virtual Desktop using Microsoft Entra ID authentication
@@ -31,9 +31,167 @@ Before you enable single sign-on, review the following information for using it
3131

3232
### Disconnection when the session is locked
3333

34-
When single sign-on is enabled, you sign in to Windows using a Microsoft Entra ID authentication token, which provides support for passwordless authentication to Windows. The Windows lock screen in the remote session doesn't support Microsoft Entra ID authentication tokens or passwordless authentication methods, like FIDO keys. The lack of support for these authentication methods means that users can't unlock their screens in a remote session. When you try to lock a remote session, either through user action or system policy, the session is instead disconnected and the service sends a message to the user explaining they were disconnected.
34+
When single sign-on is enabled and the remote session is locked, either by the user or by policy, the session is instead disconnected and a dialog is shown. Users can select the Reconnect option from the dialog when they are ready to connect again. This is done for security reason and to ensure full support of passwordless authentication. Disconnecting provides the following benefits:
3535

36-
Disconnecting the session also ensures that when the connection is relaunched after a period of inactivity, Microsoft Entra ID reevaluates any applicable conditional access policies.
36+
- Consistent sign-in experience through Microsoft Entra ID when needed.
37+
- Supports passwordless authentication like passkeys and FIDO2 devices, contrary to the remote lock screen.
38+
- Can require multi-factor authentication to return to the session and prevent users from unlocking with a simple username and password.
39+
- Reevaluates any applicable Microsoft Entra conditional access policies including sign-in frequency.
40+
- When meeting all conditional access requirements, users benefit from Entra single sign-on when reconnecting and are not prompted to re-authenticate.
41+
42+
If you prefer to show the remote lock screen instead of disconnecting the session, you can configure your session hosts using Intune, Group Policy or the registry.
43+
44+
# [Intune](#tab/intune)
45+
46+
To configure the clipboard using Intune, follow these steps. This process creates an Intune [settings catalog](/mem/intune/configuration/settings-catalog) policy.
47+
48+
1. Sign in to the [Microsoft Intune admin center](https://intune.microsoft.com/).
49+
50+
1. Select **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy**.
51+
52+
1. Enter the following properties:
53+
54+
- **Platform**: Select **Windows 10 and later**.
55+
- **Profile type**: Select **Settings catalog**.
56+
57+
1. Select **Create**.
58+
1. In **Basics**, enter the following properties:
59+
60+
- **Name**: Enter a descriptive name for the profile. Name your profile so you can easily identify it later.
61+
- **Description**: Enter a description for the profile. This setting is optional, but recommended.
62+
63+
1. Select **Next**.
64+
65+
1. In **Configuration settings**, select **Add settings**. Then:
66+
67+
1. In the settings picker, expand **Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection**.
68+
69+
1. Select the following settings and make sure you select the settings with the correct scope. The `(User)` settings apply to the user scope. The other settings apply to the device scope. To determine which scope is correct for your scenario, go to [Settings catalog - Device scope vs. user scope settings](/mem/intune/configuration/settings-catalog#device-scope-vs-user-scope-settings):
70+
71+
- Restrict clipboard transfer from server to client
72+
- Restrict clipboard transfer from client to server
73+
74+
**OR**
75+
76+
- Restrict clipboard transfer from server to client (User)
77+
- Restrict clipboard transfer from client to server (User)
78+
79+
1. Close the settings picker.
80+
81+
1. Configure the settings:
82+
83+
- **Restrict clipboard transfer from server to client**: Select **Enabled**.
84+
- **Restrict clipboard transfer from server to client**: Select the type of clipboard data you want to prevent or allow. Your options:
85+
86+
- Disable clipboard transfers from server to client
87+
- Allow plain text
88+
- Allow plain text and images
89+
- Allow plain text, images, and Rich Text Format
90+
- Allow plain text, images, Rich Text Format, and HTML
91+
92+
- **Restrict clipboard transfer from client to server**: Select **Enabled**.
93+
- **Restrict clipboard transfer from client to server**: Select the type of clipboard data you want to prevent or allow. Your options:
94+
95+
- Disable clipboard transfers from server to client
96+
- Allow plain text
97+
- Allow plain text and images
98+
- Allow plain text, images, and Rich Text Format
99+
- Allow plain text, images, Rich Text Format, and HTML
100+
101+
1. Select **Next**.
102+
103+
1. At the **Scope tags** tab (optional), you can skip this step. For more information about scope tags in Intune, see [Use RBAC roles and scope tags for distributed IT](/mem/intune/fundamentals/scope-tags).
104+
105+
Select **Next**.
106+
107+
1. For the **Assignments** tab, select the users, devices, or groups to receive the profile, then select **Next**. For more information on assigning profiles, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign).
108+
109+
1. On the **Review + create** tab, review the configuration information, then select **Create**.
110+
111+
1. Once the policy configuration is created, resync your session hosts and reboot them for the settings to take effect.
112+
113+
1. Connect to a remote session with a supported client and test the clipboard settings you configured are working by trying to copy and paste content.
114+
115+
# [Group Policy](#tab/group-policy)
116+
117+
To configure the clipboard using Group Policy, follow these steps.
118+
119+
> [!IMPORTANT]
120+
> These policy settings appear in both **Computer Configuration** and **User Configuration**. If both policy settings are configured, the stricter restriction is used.
121+
122+
1. Open **Local Group Policy Editor** from the Start menu or by running `gpedit.msc`.
123+
124+
1. Browse to one of the following policy sections. Use the policy section in **Computer Configuration** to the session host you target, and use the policy section in **User Configuration** applies to specific users you target.
125+
126+
- Machine: `Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection`
127+
- User: `User Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection`
128+
129+
1. Open one of the following policy settings, depending on whether you want to configure the clipboard from session host (server) to client, or client to session host:
130+
131+
- To configure the clipboard from **session host to client**, open the policy setting **Restrict clipboard transfer from server to client**, then select **Enabled**. Choose from the following options:
132+
- **Disable clipboard transfers from server to client**.
133+
- **Allow plain text.**
134+
- **Allow plain text and images.**
135+
- **Allow plain text, images, and Rich Text Format.**
136+
- **Allow plain text, images, Rich Text Format, and HTML.**
137+
138+
- To configure the clipboard from **client to session host**, open the policy setting **Restrict clipboard transfer from client to server**, then select **Enabled** . Choose from the following options:
139+
- **Disable clipboard transfers from client to server**.
140+
- **Allow plain text.**
141+
- **Allow plain text and images.**
142+
- **Allow plain text, images, and Rich Text Format.**
143+
- **Allow plain text, images, Rich Text Format, and HTML.**
144+
145+
1. Select **OK** to save your changes.
146+
147+
1. Once you configured settings, restart your session hosts for the settings to take effect.
148+
149+
1. Connect to a remote session with a supported client and test the clipboard settings you configured are working by trying to copy and paste content.
150+
151+
> [!TIP]
152+
> During the preview, you can also configure Group Policy centrally in an Active Directory domain by copying the `terminalserver.admx` and `terminalserver.adml` administrative template files from a session host to the [Group Policy Central Store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) in a test environment.
153+
154+
# [Registry](#tab/registry)
155+
156+
To configure the clipboard using the registry on a session host, follow these steps.
157+
158+
1. Open **Registry Editor** from the Start menu or by running `regedit.exe`.
159+
160+
1. Set one of the following registry keys and its value, depending on whether you want to configure the clipboard from session host to client, or client to session host.
161+
162+
- To configure the clipboard from **session host to client**, set one of the following registry keys and its value. Using the value for the machine applies to all users, and using the value for the user applies to the current user only.
163+
- **Key**:
164+
- Machine: `HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services`
165+
- Users: `HKCU\Software\Policies\Microsoft\Windows NT\Terminal Services`
166+
- **Type**: `REG_DWORD`
167+
- **Value name**: `SCClipLevel`
168+
- **Value data**: Enter a value from the following table:
169+
170+
| Value Data | Description |
171+
|--|--|
172+
| `0` | Disable clipboard transfers from session host to client. |
173+
| `1` | Allow plain text. |
174+
| `2` | Allow plain text and images. |
175+
| `3` | Allow plain text, images, and Rich Text Format. |
176+
| `4` | Allow plain text, images, Rich Text Format, and HTML. |
177+
178+
- To configure the clipboard from **client to session host**, set one of the following registry keys and its value. Using the value for the machine applies to all users, and using the value for the user applies to the current user only.
179+
- **Key**:
180+
- Machine: `HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services`
181+
- Users: `HKCU\Software\Policies\Microsoft\Windows NT\Terminal Services`
182+
- **Type**: `REG_DWORD`
183+
- **Value name**: `CSClipLevel`
184+
- **Value data**: Enter a value from the following table:
185+
186+
| Value Data | Description |
187+
|--|--|
188+
| `0` | Disable clipboard transfers from client to session host. |
189+
| `1` | Allow plain text. |
190+
| `2` | Allow plain text and images. |
191+
| `3` | Allow plain text, images, and Rich Text Format. |
192+
| `4` | Allow plain text, images, Rich Text Format, and HTML. |
193+
194+
37195

38196
### Active Directory domain administrator accounts with single sign-on
39197

@@ -131,11 +289,11 @@ To configure the service principal, use the [Microsoft Graph PowerShell SDK](/po
131289
id True
132290
```
133291

134-
## Configure the target device groups
292+
## Hide the consent prompt dialog
135293

136-
After you enable Microsoft Entra authentication for RDP, you need to configure the target device groups. By default when enabling single sign-on, users are prompted to authenticate to Microsoft Entra ID and allow the Remote Desktop connection when launching a connection to a new session host. Microsoft Entra remembers up to 15 hosts for 30 days before prompting again. If you see a dialogue to allow the Remote Desktop connection, select **Yes** to connect.
294+
By default when single sign-on is enabled, users will see a dialog to allow the Remote Desktop connection when connecting to a new session host. Microsoft Entra remembers up to 15 hosts for 30 days before prompting again. If users see this dialogue to allow the Remote Desktop connection, the can select **Yes** to connect.
137295

138-
You can hide this dialog and provide single sign-on for connections to all your session hosts by configuring a list of trusted devices. You need to create one or more groups in Microsoft Entra ID that contains your session hosts, then set a property on the service principals for the same *Microsoft Remote Desktop* and *Windows Cloud Login* applications, as used in the previous section, for the group.
296+
You can hide this dialog by configuring a list of trusted devices. To configure the list of devices, create one or more groups in Microsoft Entra ID that contains your session hosts, then add the group IDs to a property on the SSO service principals, *Microsoft Remote Desktop* and *Windows Cloud Login*.
139297

140298
> [!TIP]
141299
> We recommend you use a dynamic group and configure the dynamic membership rules to includes all your Azure Virtual Desktop session hosts. You can use the device names in this group, but for a more secure option, you can set and use [device extension attributes](/graph/extensibility-overview) using [Microsoft Graph API](/graph/api/resources/device). While dynamic groups normally update within 5-10 minutes, large tenants can take up to 24 hours.

0 commit comments

Comments
 (0)