Hi all, we're currently facing an issue with SSO to Office on our VDI environment. Our VDA (Windows 11 23H2) are Hybrid Joined and we're using Citrix FAS in combination with Entra ID Cert Based Authentication so that we get a PRT. Dsregcmd /status looks fine and the SSO state seems OK. However, the Office Apps are only working after the user accepts the message "Continue to sign in?". Looks like this is due to a recent change and applies only in Europe: https://techcommunity.microsoft.com/t5/windows-it-pro-blog/upcoming-changes-to-windows-single-sign-on/ba-p/4008151/page/2#comments The problem is, that this message does not appear every time and it does not persist between sessions. After reading the comments from the Microsoft Blog it seems we're not the only once having this issue. Is anyone else affected by this?

I opened a MS support case today. Win10 VDIs in my case.

We enabled roamidentity even though you should not use it for hybrid joined devices. But it seems like it's working.

Same here, created also thread about that here on 4th of september, no solution so far

Oh I must have overlooked your post. But did you try roamidentity? At the moment this seems to work for us, but not sure for how long...

We opened for this a MS Case months ago, this is the Microsofts answer to the Digital Markekt Act of Europe ... we found finally a workaround for our non-persistent desktops you can patch this file in C:\Windows\System32 called IntegratedServicesRegionPolicySet.json background, this is used to comply with DMA for EU users - as I living outside of the EU, I dont want to have this active https://pureinfotech.com/windows-11-10-json-file-control-features-eu-users/#:~:text=Microsoft%20has%20created%[…]%20file%20to%20turn%20features%20on

Nice, never heard of that file before. Need to try that later!

We neither until last friday, set, tested and rolled out ... maybe we need to script something that this file is get patched regulary as I dont know if MS will mess it up again with a Windows Update later

And I guess the required setting is "Automatic app sign-in"?

exactly - we just removed CH (Switzerland)

@Julian Jakob @Balint Oberrauch FYI, check out the comment from @Sacha Thomet

Pretty good hidden article, works great. Thanks @Sacha Thomet! It was now also commented three days ago at the techcommunity post 😄

a big thank you goes to my coworker @Stefan Moser who actually found this

We discovered this last week as well but are still checking if this is something we can implement. Cit MS: For DMA and Permit SSO is something forced By EU law we can't stop or provide any wok around as per those work around might be illegal work around.

Not illegal for non-EU countries

Correct.