Hide the AVD SSO Consent Prompt

Azure Virtual Desktop (AVD) offers a seamless sign-in experience with Microsoft Entra ID single sign-on. However, users may still encounter a consent prompt during authentication. This guide explains how to hide that prompt and provide a smoother, mor


Hide the AVD SSO Consent Prompt with the New Azure Portal Option

Azure Virtual Desktop now includes a dedicated configuration option in the Azure portal for managing trusted target device groups. This allows administrators to configure SSO consent settings through a graphical interface instead of using PowerShell.

Once configured, users connecting to session hosts in the selected groups no longer see the consent prompt, resulting in a smoother and more seamless sign-in experience.

Prerequisites

Before configuring this feature, make sure that:

  • Microsoft Entra ID single sign-on is enabled for your AVD host pool.
  • Your session hosts are joined to Microsoft Entra ID or Microsoft Entra hybrid joined
  • You have permission to manage Microsoft Entra applications and device groups.
  • You have a Microsoft Entra ID P1 or Intune for Education license if you want to use dynamic groups.

Create a device group

First, create a dynamic device group containing the AVD session hosts for which you want to hide the consent prompt.

  1. Sign in to the Azure Portal
  2. Open Microsoft Entra ID
  3. Go to Groups and select New group.
  4. Set Group type to Security.
  5. Set Membership type to Dynamic Device.
  6. Configure a dynamic membership rule that includes your AVD session hosts.
  7. Enter a meaningful group name, such as AVD-Session-Hosts-SSO.
  8. Create the group.

Note
Dynamic group membership usually updates within 5–10 minutes. In large tenants, updates can take up to 24 hours.

Configure trusted device groups for AVD SSO

After creating the group, configure it in the Windows Cloud Login service principal.

  1. In the Azure portal, search for and open Microsoft Entra ID.
  2. Select Devices under Manage.
  3. Open Remote connection configuration.
  4. Select Windows Cloud Login.
  5. Locate Target device groups to enable SSO.
  6. Select the link below this setting.
  7. Search for and select the dynamic device group you created earlier.
  8. Select Save.

You can configure up to ten device groups.

Test the configuration

After the group membership has been updated, connect to an affected AVD session host using Windows App or the browser. The consent prompt should no longer appear for session hosts included in the configured device groups.

 

Conclusion

Configuring trusted target device groups is a simple way to improve the Azure Virtual Desktop sign-in experience. By using the Azure portal, administrators can now hide the SSO consent prompt without relying on PowerShell commands.

You might also like
Tags: Azure Virtual Desktop, Microsoft

More Similar Posts