Add an SSO Configuration for an Entra ID SSO

When using Horizon Cloud with the Microsoft Azure provider type, Azure-provisioned desktop VMs support single sign on for Entra ID-joined desktops.

This feature supports single sign-on (SSO) to remote desktops and applications for Windows Horizon Clients.

Note: This feature is not supported for Mac, Linux or Web Clients. It is also not supported for use with Workspace One Access.

For related information, see Requirements Checklist for Deploying a Microsoft Azure Edge.

Prerequisites

At the time of this writing, the prerequisites for configuring Entra ID SSO for Azure-provisioned joined desktop VMs are as follows. To ensure current accuracy over time, see the Horizon Cloud Release Notes and the Omnissa Interoperability Matrix for any updates.

• Omnissa Horizon Client version 2512 or later (Windows Client).
• Host OS for client has to be at below minimum versions.
• Windows 11 24H2 Enterprise single session with the Oct 2025 Security Cumulative Update or later installed.
• Windows Server 2025 with the Jan 2026 Security Cumulative Update or later installed.
• Omnissa Horizon Agent version 25.4.0 or later.
• IDP Registration from HCS Admin Portal.
• Entra ID Per-Tenant Configuration.
• Pool provisioned with machine identity Microsoft Entra ID.
• Pool Group SSO Enabled.
• Microsoft Entra ID P1 License. This licence is required to create and configure a trusted device group for seamless SSO. If this requirement is not satisfied, a one-time consent prompt appears during your first launch attempt.
• Register IDP with provider type Microsoft Entra ID. The IDP integration process ensures Omnissa Resource App Principal Registration in your tenant.

Run the PowerShell script

Omnissa Support can provide a PowerShell script to automate this procedure. For related information, see SSO to Microsoft Entra ID joined desktops and applications through Workspace ONE Access.

Elements of the PostScript file are provided below:

• Configure the Graph Access Token: Generate the access token by using your application principal with the following permissions enabled:

  • Application-RemoteDesktopConfig.ReadWrite.All
  • Application.Read.All

  ./EntraID-ConfigureSSO.ps1 -Action getGraphAccessToken -TenantId "<AZURE_TENANT_ID>" -ClientId "<AZURE_APP_CLIENT_ID>" -ClientSecret "<AZURE_APP_CLIENT_SECRET>"

• Check SSO: Check the current SSO configuration status for Resource App and Client Apps. Optionally verifiy Trusted Device Group configuration

  .\EntraID-ConfigureSSO.ps1 -Action checkSso -Token $env:token [-TrustedDeviceGroupObjectId <DEVICE_SECURITY_GROUP_OBJECT_ID>]

• Configure SSO: Configure SSO for Resource and Client Applications. Optionally configure a Trusted Device Group.

  .\EntraID-ConfigureSSO.ps1 -Action configureSso -Token $env:token [-TrustedDeviceGroupObjectId <DEVICE_SECURITY_GROUP_OBJECT_ID>]

• Remove the Service Principal: This is an optional step to remove a previously registered application, if cleanup is needed.

  .\EntraID-ConfigureSSO.ps1 -Action removeServicePrincipal -AppId <RESOURCE_OR_CLIENT_APP_ID>

Grant Admin Consent for the Resource

After you run the PowerShell commands, open the Azure Portal and manually grant administrator consent for the resource application, as below:

1. In the Azure Portal, click Azure Active Directory > Enterprise Applications.
2. Search for and locate your client resource app Horizon Cloud Service Client.
3. On the Permissions tab, click Grant admin consent.

Known Considerations

• Entra SSO works after the device has a fully joined Entra ID. In some cases, this process may take a few seconds even after the pool VM is shown as Provisioned and reported as Available. In such scenarios, end-users may be prompted for credentials.

• For an SSO configuration with a trusted device group, MSFT Dynamic group processing may take several minutes. In such cases, end-users may notice a one-time consent prompt if a desktop or application application is accessed before device membership update is complete.