Azure Virtual Desktop: External identity sign-in via Windows App fails when switching to resource tenant - error 0x8AA5015A

Mick Neple 0 Reputation points
2026-07-24T13:18:21.7566667+00:00

Service: Azure Virtual Desktop, Windows App, Microsoft Entra External ID (B2B guests)

Scenario: AVD configured for external identity (guest) access — SSO enabled on host pool, both required service principals (Windows Cloud Login, Microsoft Remote Desktop) confirmed IsRemoteDesktopProtocolEnabled: True, guest correctly assigned to app group with RBAC + workspace in place. Guest signs in and switches org to the resource tenant.

Result: Works via AVD Web Client (windows.cloud.microsoft) — RemoteApp launches fine, confirming config is correct. Fails every time via native Windows App, for both RemoteApp and Desktop.

using windows app i select "sign in with another account" followed by "sign in to an organizaiton". I provide the domain for the tenant I have guest access and AVD with RemoteApp, I enter my external org. credentials and I receive the following error, with an AAD log entry containing the same correlation ID

Client error:

Something went wrong. [9zj1q]
Code: 5
correlation ID: ed89f9e2-38a4-4b07-8101-9d0787c34b3f
Message: An unpexpected error occured

Broker log:

Error: 0x8AA5015A — resetting auth context due to resource tenant change
AuthenticationContext.cpp:986, CompleteRequest
client: 4fb5cc57-dbbc-4cdc-9595-748adff5f414
correlation ID: ed89f9e2-38a4-4b07-8101-9d0787c34b3f

Environment: Entra-joined session hosts, Win11 24H2/25H2. Reproduced on two separate machines, both build 26200.8894/KB5121767 (past the Jan 2026 KB5073379/5074109 regression + fix).

Troubleshooting done: Verified group membership, app group assignment, workspace link, RBAC, and both service principals — all correct. Confirmed on a second machine to rule out local corruption. Web Client works with the same identity/resources.

Question: Is this a known limitation in Windows App's cross-tenant org-switch for external identities on AVD? Is Web Client the expected path for now, or is a fix planned?

Azure Virtual Desktop
Azure Virtual Desktop

A Microsoft desktop and app virtualization service that runs on Azure. Previously known as Windows Virtual Desktop.

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Christos Panagiotidis 3,546 Reputation points
    2026-07-24T16:14:29.3766667+00:00

    The web client working with the same guest identity confirms that the host pool, app-group assignment, and basic external-access configuration are functional. Microsoft documents external-identity access for Azure Virtual Desktop, but it does not publicly identify error 0x8AA5015A as a general Windows App limitation or publish a fix date. Update Windows App, sign out every account, remove the workspace, close the app, and add the external account and workspace again. Confirm the host pool and session hosts meet the documented Microsoft Entra single sign-on requirements. Reproduce the failure and review Microsoft Entra sign-in logs using the UTC time and correlation ID, then collect Windows App diagnostics. Test from a clean Windows profile to separate cached client state from tenant configuration. Continue using the web client as the supported workaround. If the error remains, open Microsoft support with the correlation ID, client logs, app version, and working web-client comparison.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.