Sanity check for O365 in XenApp on Server 2016: Outside of having AD sync configured for the VDA, device registration enabled via GPO, and dsregcmd /leave in the sealing script before shutting down the image (PVS), is there anything else required for hybrid-joining a VDA to work? Seeing weird results in our environment on S16, whereas W10 works fine. We're using Okta Silent Authenticaton, so it's not exactly a simple config (no PRTs), but I would expect it to behave the same. Even the Workplace Join task on S16 is different, having no switches in the command line.

Upgrade to 2022.

Trust me, I'm working these guys on that, but we have no choice but to get this working for now.

Do you have certificate based auth enabled and are you using aad for logon? I think both are required to get a prt or your idp needs to use a different way to create it.

We have FAS, but are using Okta to get around it

So Entra ID is federated to Okta? That would explain why you have to sign-in again. It probably isn't getting the token from the initial login.

Then okta needs to get you the prt I think

Nah, we're using their Silent Activation feature right now, which doesn't require a PRT. It's goofy.

You can check that all tjhis stuff has been done https://help.okta.com/en-us/content/topics/apps/apps_o365_silent_activation.htm

We're going to pull in an Okta resource. I know we were testing a new method from them in XD, so I wonder if we can do that in S16 instead. Supposed to be a way to get PRTs with FAS, IIRC

I think it using kerberos to get the prt so if you get a kerberos ticket which you do wiht fas then you also get a prt

If you login and immediately lock the session and reauth do you get a prt and SSO works?

We don't get a PRT at all because we're using Okta and FAS.

Using fas here and if I lock/unlock I get a prt so was curious

Do this Matt and you can get a PRT at login. https://www.jeffriechers.com/wiki/azuread-prt-with-fas-certificates/