Windows App SSO Authentication to AVD Connection Issues

Question

Windows App SSO Authentication to AVD Connection Issues

Tina Wilson 0

We are deploying an Azure Virtual Desktop environment using Windows 11 Enterprise multi-session, Microsoft Entra ID join, and Intune management. The session host is healthy, Entra joined, Intune compliant, and accessible through the AVD service.

Users can successfully authenticate to Windows App and Azure Virtual Desktop using MFA, but launching the desktop fails during the Microsoft Entra SSO / Windows Cloud Login authentication stage.

Key details:

Azure Virtual Desktop authentication succeeds.
Windows Cloud Login authentication fails.
Host pool has enablerdsaadauth:i:1 configured.
Windows Cloud Login IsRemoteDesktopProtocolEnabled = True.
User has the Virtual Machine User Login Azure RBAC role.
User has Microsoft 365 G3 GCC licensing.
Session host is Entra joined and Intune compliant.
Both Windows App and the Windows web client reproduce the failure.
Web client successfully negotiates RDS AAD Auth, obtains the AAD nonce, and connects to the AVD gateway.
Failure occurs specifically during AcquireRDSAADToken.
Entra returns Error 50033 / temporarily_unavailable, indicating both the Primary and Backup Authentication Services failed the token request. fileciteturn1file0
Windows App has also returned AADSTS54005 – OAuth2 authorization code was already redeemed.

The issue appears isolated to Windows Cloud Login / RDS AAD bootstrap-token acquisition rather than AVD networking, VM registration, licensing, Intune compliance, or Azure RBAC. We need assistance determining why Entra is unable to issue the RDS AAD authentication token for this tenant/user.

0 comments

1 answer

Your answer

Answer 1

The supported troubleshooting path points to Conditional Access and SSO policy evaluation for the Windows Cloud Login app, not the Azure Virtual Desktop service path itself.

Verify the Azure Virtual Desktop SSO prerequisites.
- Confirm SSO is enabled on the host pool.
- Confirm both apps exist in the tenant:
  - Azure Virtual Desktop app: 9cdead84-a844-4324-93f2-b2e6bb768d07
  - Windows Cloud Login app: 270efc09-cd0d-444b-a71f-39af4910ec45
- Confirm per-user MFA is disabled for Azure Virtual Desktop users. Azure Virtual Desktop with Microsoft Entra joined session hosts must use Conditional Access rather than legacy per-user MFA.
Check sign-in logs for the failed Windows Cloud Login transaction.
- In the Microsoft Entra admin center, go to Identity > Monitoring & health > Sign-in logs.
- Filter by the affected user and the failure timeframe.
- Review entries for both Azure Virtual Desktop and Windows Cloud Login.
- For the failed Windows Cloud Login entry, inspect:
  - Sign-in error code
  - Conditional Access tab to see which policy blocked or failed
  - Authentication Details tab to see which method was required or used
Review Conditional Access design for Azure Virtual Desktop SSO.
- Azure Virtual Desktop SSO uses two apps, and their policies must be aligned:
  - Azure Virtual Desktop for feed subscription and gateway authentication
  - Windows Cloud Login for session host sign-in
- If these policies are misaligned, users can get repeated prompts or connection-time authentication failures.
- If any policy targets All cloud apps, review it carefully because it can block Azure Virtual Desktop SSO unexpectedly.
Check for the common Conditional Access misconfigurations that specifically break Windows Cloud Login.
- Per-user MFA enabled alongside Conditional Access: disable per-user MFA and use Conditional Access only.
- Windows Cloud Login missing from Conditional Access: add it to the SSO Conditional Access policy.
- Device compliance required by a policy targeting Azure Virtual Desktop or Windows Cloud Login: that compliance requirement applies to the client device, not the session host.
- Location-based restrictions: test both apps, because the IP evaluated for Windows Cloud Login can differ from the client IP depending on routing.
- Windows 365 app blocked: the Windows App authenticates to both Azure Virtual Desktop and Windows 365, even if only Azure Virtual Desktop resources are assigned. A policy blocking Windows 365 can cause sign-in failure.
- Do not add Azure Virtual Desktop Azure Resource Manager Provider (50e95039-b200-4007-bc97-8d5790743a63) to Conditional Access policies.
Validate expected post-configuration behavior.
- After SSO and Conditional Access are configured correctly, the expected result is:
  - one authentication flow in Windows App
  - entry into the session without a second credential prompt
  - successful sign-in log entries for both Azure Virtual Desktop and Windows Cloud Login
- If either app shows Failure, the Conditional Access tab identifies the blocking policy.
For the authorization/session errors already observed, apply the documented client-side remediation where relevant.
- For AADSTS50058: SSO session not found or invalid:
  1. Sign out of the Windows App.
  2. Sign in again.
  3. If it persists, clear the Web Account Manager cache on the client device.
- For AADSTS50076:
  - confirm the user has a registered MFA method
  - disable per-user MFA if enabled
  - verify the connection satisfies Conditional Access conditions

Based on the symptoms provided, the highest-value next step is to inspect the Windows Cloud Login sign-in log entry and identify the exact Conditional Access result for that app. The documented Azure Virtual Desktop guidance shows that failures at the Windows Cloud Login stage are commonly caused by policy targeting, per-user MFA conflicts, device-compliance requirements applied to the wrong device, or app coverage gaps between Azure Virtual Desktop, Windows Cloud Login, and Windows 365.

References: