Forum Discussion
Windows App Multiple Work Accounts
We are trying to use multiple work accounts to access AVD host pools (regular user account and privileged user account for administration work). When adding the second account I can see the desktop assigned to it but when I try to connect, Windows App attempts to the use the first user account and AVD returns an error the connection is denied because the user account is not authorized for remote logins. We've identified it's using the wrong account to connect. Is this not supported? Why would you be able to add multiple accounts if Windows App doesn't know which one to use?
3 Replies
The Windows App allows adding multiple work accounts for convenience, but only one Entra ID token is active per tenant, so it cannot distinguish between multiple accounts from the same organization during connection. Consider using separate Windows profiles or the web client until multi‑account support is expanded.
https://learn.microsoft.com/en-us/azure/virtual-desktop/authentication
Windows App supports multiple work accounts, so adding your privileged account is supported. However, AVD requires the same identity for service authentication and session-host sign-in. Discovering a desktop as one user and signing into Windows as another is not supported.
In Windows App, select the intended account through the top-right profile menu, then launch that account's desktop. Test again after signing the regular account out of the app, without disconnecting Windows from your organization.
Have your administrator check which identity reaches the session host and whether SSO is enabled. Capture the Windows App version, expanded error details, and failure time for Microsoft support if the wrong identity persists.
If your privileged account is a Domain Admin, Microsoft recommends signing into the session with a non-administrator account and elevating individual administrative tools instead. The screenshot alone does not establish why the wrong identity was selected.SSO is enabled which seems to be the culprit. Removing the the regular account has no effect indicating Windows app is not using the credentials provided when adding the account but rather a token from Windows/WAM/PRT. Using the webclient works fine. If I give my regular account access to the desktop, then it works and that's the account that's logged in even though I launch it under the privileged account.
