HOW TO: Hiding the consent prompt for Single Sign-On

[David Belanger]

We've been working on the ability to hide the dialog shown to users on first connection to a new session host when Single Sign-On is enabled to allow the remote desktop connection. The steps have now been published. To get started, review the new steps to configure Single Sign-On on your Azure Virtual Desktop Host Pool:
Configure single sign-on for Azure Virtual Desktop using Microsoft Entra authentication - Azure | Mi...

[#2]

Thanks David I am going to test the Configure the target device groups as soon as possible

[#3]

This is great news, but the instructions, not so much. We could benefit from some more detail.

[#4]

Thank you for the feedback @Andrew Allston. I plan to add a sample step-by-step instruction using Graph Explorer for those less familiar with using Microsoft Graph. Hoping to have it live the week after Thanksgiving at the latest.

[#5]

Thank you! Much appreciated! Have a happy Thanksgiving! 🦃

[#6]

Thanks, that is really nice

[#7]

@Andrew Allston for anyone else a bit confused and wants to try before the detailed instructions are posted. The available links seem to suggest you need to create these attributes/objects. But you are modifying the SPNs for the two applications listed in the docs. This means PATCH should be used and not POST which is the method which is linked to.

[#8]

@Andrew Allston You are right. To create a remoteDesktopSecurityConfiguration object on a supported Service Principal (RDP resource) you have to use PATCH and set the isRemotedDesktopProtocolEnabled property. Once you have created the RDSC object you have to create targetDeviceGroup object and you can do that by using POST. If you need to add more device groups to the targetDeviceGroup object you can do so one at a time by again doing a POST call. The only time you will use PATCH call on targetDeviceGroup is if you need to update display name for the group. Hope this helps. I will updating the docs shortly to reflect this change from POST to PATCH when creating RDSC object.

[#9]

Hi @David Belanger ,
Could you please do this step-by-step instruction ? I'm not familiar with MS Graph. I spent some time to figure out how to make this work without success... Thanks in advance it will be much appreciated !

[#10]

@Florian_Paternostre see if this article provides you the required information - Use the Microsoft Graph API - Microsoft Graph | Microsoft Learn

[#11]

@Sandeep Deo Thanks for the article. 
I tried to do it with Graph Explorer without success. 
I verified and assigned all required permissions (my account is global admin and I have consent all required permissions to Graph Explorer).
When doing the POST request to create the setting, I get the following error : 

Do I use the correct servicePrincipals ? 

I tried the following IDs :

• Microsoft Remote Desktop (App ID a4a365df-50f1-4397-bc59-1a1564b8bb9c).
• Windows Cloud Login (App ID 270efc09-cd0d-444b-a71f-39af4910ec45)

[#12]

You need to look up those apps in your Directory and grab the object ID (SPN) for those app IDs and use those and NOT the app IDs themselves.

And since these exist already you need to use PATCH not POST to update the record. You will need to use POST for the next step when creating the group.

And remember you can always test with GET.

[#13]

Thanks a lot @Andrew Allston, This is exactly the information I needed. 
I was able to configure it :)

[#14]

@Florian_Paternostre / @Andrew Allston / @gkolk001 Thank you for the feedback. I've finished updating the public documentation with additional information, hopefully it's a bit clearer now:
Configure single sign-on for Azure Virtual Desktop using Microsoft Entra ID authentication | Microso...

Feel free to provide additional feedback.