All of our external customers have their own AAD / Entra ID and wish to not manage multiple identities. As we present our applications via AVD, it requires them to have a separate identity in our tenant currently. AVD should support guest accounts from another tenant to be able to sign in.
Currently, per the documentation and per the ticket I just worked with Microsoft support:
Azure Virtual Desktop doesn't support external identities, including guest accounts or business-to-business (B2B) identities. Whether you're serving internal commercial purposes or external users with Azure Virtual Desktop, you'll need to create and manage identities for those users yourself.
Please continue development to allow guest accounts that have been invited into a tenant to sign in to AVD machines. Thanks!
6 Comments
Hi. Does anyone have an update on external identities for AVD? I understand it has been under development for some time. Does anyone have a timeframe for a preview version? Thanks!
Regarding the EntraID federation option described here (https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/whatis-fed) - requiring organizations to implement/maintain additional identity infrastructure (i.e. ADFS or PingFederate) just for granting access to AVD is an awkward/impractical solution to say the least.
To further note, the need to offer external identities access to AVD is not just driven by the external facing customer scenarios but also applicable to organizations that leverage multi-tenants for creating the necessary security (identity) boundaries even for organization's own users.
TaniaMariscal / Microsoft PG Teams (AVD, Entra ID) - please incorporate this capability (B2B support for AVD) into the relevant product roadmaps.
TaniaMariscal Thank you for changing the status! What is the usual timeframe for such change request to go from 'Under Review' stage to 'Completed'?
This has become a significant roadblock to use Azure VD as a solution, where it is not accepted by large corporates and is holding our implementation team.
The workaround can be to set up a federation trust between main tenant and customers' tenants using Azure AD Federation. This allows users to authenticate in their own tenant but gain access to services in the main tenant without needing separate credentials.
However, federation requires some setup and collaboration between IT teams from both organizations.
TaniaMariscalMicrosoft
Status changed:NewtoUnder reviewbrettwci Hi, did you manage to find any workaround to support external identities?
