Require authentication using Microsoft Entra ID

Before you can configure the setting to require single sign-on using Microsoft Entra ID, you need to meet the following prerequisites:

• Target devices providing the remote session to your users:

  • For Azure Virtual Desktop, these are the session hosts.
  • For Windows 365, these are the Cloud PCs.

• You have configured single sign-on using Microsoft Entra ID and tested that user connections are successful:

  • For Azure Virtual Desktop, see configure single sign-on for Azure Virtual Desktop.
  • For Windows 365, see configure single sign-on for Windows 365.

  Important

  If you don't confirm that single sign-on using Microsoft Entra ID connections are successful, your users could be prevented from signing in.

• Target devices running Windows 11 single or multi-session with the 2026-09 Cumulative Updates for Windows 11 (KB5124010) or later installed. This update allows Intune to be the policy source.

• A Microsoft Entra ID account that's assigned the Policy and Profile manager built-in RBAC role.

• A group containing the devices you want to configure.

Before you can configure the setting to require single sign-on using Microsoft Entra ID, you need to meet the following prerequisites:

• Target devices providing the remote session to your users:

  • For Azure Virtual Desktop, these are the session hosts.
  • For Windows 365, these are the Cloud PCs.

• You have configured single sign-on using Microsoft Entra ID and tested that user connections are successful:

  • For Azure Virtual Desktop, see configure single sign-on for Azure Virtual Desktop.
  • For Windows 365, see configure single sign-on for Windows 365.

  Important

  If you don't confirm that single sign-on using Microsoft Entra ID connections are successful, your users could be prevented from signing in.

• Target devices running Windows 11 single or multi-session with the 2026-05 Cumulative Updates for Windows 11 (KB5089573) or later installed.

• A domain account that has permission to create or edit Group Policy objects.

• A security group or organizational unit (OU) containing the devices you want to configure.

To configure the setting to require single sign-on using Microsoft Entra ID by using Intune, follow these steps.

1. Sign in to the Microsoft Intune admin center.

2. Create or edit a configuration profile for Windows 10 and later devices, with the Settings catalog profile type.

3. In the settings picker, browse to Administrative templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security.

4. Check the box for Enable Microsoft Entra ID Authentication Enforcement, then close the settings picker.

5. Expand the Administrative templates category, then toggle the switch for Enable Microsoft Entra ID Authentication Enforcement to Enabled.

6. Select Next.

7. Optional: On the Scope tags tab, select a scope tag to filter the profile. For more information about scope tags, see Use role-based access control (RBAC) and scope tags for distributed IT.

8. On the Assignments tab, select the group containing the target devices you want to configure, then select Next.

9. On the Review + create tab, review the settings, then select Create.

10. Once the policy applies to the target devices, restart them for the setting to take effect.

11. You can test the behavior by initiating a connection that doesn't use single sign-on using Microsoft Entra ID, which should result in a connection error titled ENTRA_AUTH_REQUIRED_BY_SERVER.

To configure the setting to require single sign-on using Microsoft Entra ID by using Group Policy, follow these steps.

1. Open the Group Policy Management console on the device you use to manage the Active Directory domain.

2. Create or edit a policy that's assigned to your target devices providing the remote session to your users that you want to configure.

3. Navigate to Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security.

4. Double click the Enable Microsoft Entra ID Authentication Enforcement policy setting.

5. Set the policy to Enabled, and then select OK.

6. Ensure the policy is applied to your target devices, then restart them for the settings to take effect.

7. You can test the behavior by initiating a connection that doesn't use single sign-on using Microsoft Entra ID, which should result in a connection error titled ENTRA_AUTH_REQUIRED_BY_SERVER.