Azure Virtual Desktop supports greater application and identity functionality with latest updates

Microsoft

Jun 02, 2026

At Microsoft Ignite 2025, we announced both the general availability of external identity support in Azure Virtual Desktop and the public preview support of using FSLogix and Azure Files as a user profile management solution for external identities in Azure Virtual Desktop. These were the foundational building blocks to provide desktop or RemoteApp access to users outside your organization in a seamless manner, without having to create brand new user accounts for them.

To see more technical guidance and details, visit our Learn page for External identity support.

We have heard from application developers that they want to leverage these capabilities and even incorporate their own Security Assertion Markup Language (SAML) identity provider (IdP) that their application ecosystem depends on. Since then, we’ve continued listening to feedback and investing in key areas to help you build, deploy, and sell your own application solutions to customers. We’re excited to share the following updates:

Using FSLogix as a user profile management solution for external identities with Azure Virtual Desktop is now generally available.
Configuring a SAML IdP as domainless is now in public preview.
Connecting to Azure Virtual Desktop in Azure for US Government with an external identity is generally available.
Connecting to Azure Virtual Desktop with an external identity in Azure public cloud is in preview on Android and macOS

Updates to configuring FSLogix on Azure Files for external identities (generally available)

To provide a streamlined user experience for external identity users in an Azure Virtual Desktop pooled environment, you can create a file share in Azure Files to store the FSLogix profiles for these identities.

In addition, Azure Virtual Desktop now supports Azure Role-based Access Control (“RBAC”), which is generally available. Instead of using a default share-level permission for access to the file share, you can create custom permissions with Azure RBAC.

The addition of Azure RBAC support does not change the file and directory permissions you assign to users. You must still create the appropriate access control lists (ACLs) such that the Azure Virtual Desktop session hosts can either: (a) attach the user’s existing FSLogix user profile or (b) use the logged-in user’s permissions to create a new FSLogix user profile for the user if it doesn’t exist.

Configure domainless SAML IdP federation (public preview)

With traditional federation in Microsoft Entra, the domain name in a user’s email was required to match the domain name registered and associated with the configured SAML IdP. This works well for External ID in workforce tenants, helping organizations to maintain single sign-on and route users to their home Entra ID tenant for authentication. However, it’s overly restrictive for application developers who require user accounts from their specific IdP.

With the latest changes, you can now configure your SAML IdP to be domainless, such that a user’s email address domain no longer is required to match the IdP domain name.

By selecting Domainless, you can allow customers and users to set up an account with an email address they know, without requiring the email domain to match the IdP domain name.

Expand user access to more platforms and clouds

For commercial cloud Azure Virtual Desktop environments, we expanded external identity sign-in preview support to both:

Windows App Beta on macOS, version 11.2.0 (2898)
Windows App on Android, version 11.0.0.94 or later

You can also deploy your application for customers in US Government, with external identity support provided in the Windows App (Windows), version 2.0.964.0 or later.

Resources to get started