We are currently facing issues with SSO for office applications. Hope some of you can point me in the right direction. CVAD 2407 CR Storefront 2407 CR FAS 2407 Non-persistent W10 vdi 22H2 FSLogix ODFC + Profile container Pass-through auhtentication with Enable SSO. https://autologon.microsoftazuread-sso.com has been set as a HKCU Site to Zone Assignment List Allow updates to status bar via script is enabled as HKCU Storefront and VDA's have the adresses of the FAS servers. XML trust is enabled dsregcmd /status: - AzureAdjoined: No - DomainJoined: Yes - AzureADPrt: No When a new user logs into the workplace they need to login after starting office. They need to put in their emailaddress and password. Same applies for Teams V2. Only difference is that they can select their emailaddress but need to put in their password If the user logs off and on again they get a message in office "Account error, There are problems with your account" They need to login again.

It sounds like you have 2 issues. One being SSO and 2 a roaming issue (corrupt your account) as even if SSO didn't work, it should cache the creds next time. Re the roaming, you have ODFC and profile container, why 2? it could cause some issues.

We've been running ODFC and Profile container separately for all of our customers. Could be a legacy thing that never changed. Actually we've never ran into issues that was related to the containers being separately Attached are screenshots of the Fslogix policy. Roam identity is also set to enabled in the same GPO.

I just heard many times here that doing both is not recommended, I don't have a personal experience. Was it working before? Any recent changes? Also if your SSO was working, maybe your roaming never worked, that's probably what is happening.

I resovled htis in our environment by removing fslogix and using Citrix Profile COntainers and including the entire profile. Now users dont have to login to office anymore, for us.

So to update this case, i've now implemented Hybrid join to a POC machine catalog at our customer. AzureAdJoined : YES EnterpriseJoined : NO DomainJoined : YES AzureAdPrt : NO But when the user disconnects and reconnects it changes to YES. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Common\Identity\EnableADAL has been set to 1 HKEY_LOCAL_MACHINE\SOFTWARE\Policies\FSLogix\ODFC\IncludeOfficeActivation has been set to 0 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Autoorgidgetkey has been set to 1 Office is installed with the following parameters: Property Name="AUTOACTIVATE" Value="1" / Property Name="DeviceBasedLicensing" Value="0" / Property Name="SCLCacheOverride" Value="0" / Property Name="SharedComputerLicensing" Value="1"/ And still when starting office the users needs to authenticate. The only upside is that SSO in Edge now works when we go to portal.office.com Be aware that we are based in Europe and are facing SSO issues since Microsoft made changes to comply with Digital Markets Act (DMA) https://techcommunity.microsoft.com/blog/windows-itpro-blog/upcoming-changes-to-windows-single-sign-on/4008151

On the base image did you modify the workplace join Scheduled Task to run at logon and at startup? You need to have it run once to register the machine, and the second time at logon does the user. That is why you see it show up like that on a reconnect. It does a second pass for the user and registers it correctly.

If you're hybrid-joined and using FAS and expect SSO to work, you need to enable cert-based auth for azure: https://docs.citrix.com/en-us/federated-authentication-service/2303/config-manage/aad-sso.html Since FAS authenticates the user by supplying a certificate to the VDA, a PRT can only be created if certificate-based authentication for AAD is implemented.

Okay. It took a while but there is a new update. SSO works flawlessly. The issue i posted last time was fixed by creating a new (golden) image and deploying that to the VDA's. Now, something else interesting pops up. When a (new) user does not have any Authentication methods configured they are facing the same error as @Julian Jakob posted on his blog (https://www.julianjakob.com/citrix-fas-entra-id-cba-with-a-prt/) "Certificate validation failed" Only when i exclude myself or disable the Microsoft managed System-preferred multifactor authentication i am able to enroll the Microsoft authenticator. This behavior is the same in the VDA session or at the users personal computer. Is this "Certificate validation failed" to be excepted or am i missing something? To add. The only authenticator methods we allow are the Microsoft Authenticator for all users and the CBA for the Citrix users

To be expected, unfortunately

@Farid two Workarounds for that. First is to exclude from the group, as you already did. Second one (which I prefer) is to create a TAP for that user. Wait about 10 minutes and then the user has to logon to aka.ms/mfasetup with the TAP. With TAP, MS accepts the creation of a MFA method and ignores CBA.

@Julian Jakob can you explain what TAP stands for?

Temporary Access Pass

OK. Will look into that.

Or you can bind CBA to a specific group and have a script run regularly that will add or remove users to that group depending if MFA has been configured for a user or not.

Are you doing this currently Joost? We are considering it, but worried that the script may not be quick enough to remove the group before the user contacts support..

Great Idea Joost, also interested if you're using that in a prod-environment without issues 🙂

Yes, we are currently doing that with Azure Automation in production for several customers. It does prevent not all but most calls to support.

Would you be able to share some more details about how you are running the script, and the script itself? Would be interested in seeing if you are doing anything else than what we were doing in test

Here you go. Credits are for my colleague.

Disclaimer: This code is provided “as-is” without any warranty of correctness, functionality, or fitness for a particular purpose. Use it at your own risk. The author is not responsible for any damage, loss, or errors resulting from its use. Carefully review and test the code before deploying it in a production environment.

Azure Automation Subscription • Create subscription • Give a Global Administrator account owner rights • Subscription renamed to SUB-ICT Resource group • Create resource group MGMT-RG-ICT-AA in subscription SUB-ICT Automation account • Create Azure Automation Account “MGMT-AUTO-MFA” in subscription SUB-ICT Entra ID Group • Create an Entra ID functional group “MFA-AuthenticatorEnabledUsers” • Save the group id for later reference Rights for the Automation Account

connect-azuread 
$TenantID = "[TENANTID]" 
$DisplayNameOfMSI= "MGMT-AUTO-MFA" 
$GraphAppId = "00000003-0000-0000-c000-000000000000" 
$PermissionName1 = "User.Read.All" 
$PermissionName2 = "Group.ReadWrite.All" 
$PermissionName3 = "UserAuthenticationMethod.Read.All" 
$MSI = (Get-AzureADServicePrincipal -Filter "displayName eq '$DisplayNameOfMSI'") 
Start-Sleep -Seconds 10 
$GraphServicePrincipal = Get-AzureADServicePrincipal -Filter "appId eq '$GraphAppId'" 
$AppRole = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName1 -and $_.AllowedMemberTypes -contains "Application"} 
New-AzureAdServiceAppRoleAssignment -ObjectId $MSI.ObjectId -PrincipalId $MSI.ObjectId -ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole.Id 
$AppRole = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName2 -and $_.AllowedMemberTypes -contains "Application"} 
New-AzureAdServiceAppRoleAssignment -ObjectId $MSI.ObjectId -PrincipalId $MSI.ObjectId -ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole.Id 
$AppRole = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName3 -and $_.AllowedMemberTypes -contains "Application"} 
New-AzureAdServiceAppRoleAssignment -ObjectId $MSI.ObjectId -PrincipalId $MSI.ObjectId -ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole.Id

• Open the just created Azure Automation account • Remove demo runbooks if present • Create a new runbook MGMT-AUTO-RB-MFAEnabledUsers ◦ Runbook type: Powershell ◦ Runtime version: 7.2 ◦ In shared resources. Add gallery modules on runtime version 7.2: ▪︎ Microsoft.Graph.Authentication ▪︎ Microsoft.Graph.Groups ▪︎ Microsoft.Graph.Identity.SignIns ▪︎ Microsoft.Graph.Users ◦ In script modify the group id en write-output:

Connect-AzAccount -Identity -ErrorAction Stop | Out-Null 
$AccessToken = Get-AzAccessToken -ResourceTypeName MSGraph -ErrorAction Stop | select -ExpandProperty Token 
$targetParameter = (Get-Command Connect-MgGraph).Parameters['AccessToken'] 

if ($targetParameter.ParameterType -eq [securestring]){ 
  Connect-MgGraph -AccessToken ($AccessToken |ConvertTo-SecureString -AsPlainText -Force)  -NoWelcome 
} else { 
  Connect-MgGraph -AccessToken $AccessToken -NoWelcome 
} 
Write-Output "Connected to Microsoft Graph"

$users = get-mguser  -All -Filter "OnPremisesSyncEnabled eq true and UserType eq 'Member'" 
Write-Output "All synced members retrieved" 
$groups = Get-MgGroupMember -GroupId ' 700a03be-fd2d-4646-b5f5-d49470bfaff2’ 
Write-Output "Members of group F_MFA-AuthenticatorEnabledUsers retrieved" 
$results=@(); 

#loop through each user account 
foreach ($user in $users) { 
	$myObject = [PSCustomObject]@{ 
		user               = "-" 
		displayname        = "-" 
		MFAstatus          = "_" 
		app                = "-" 
		password           = "-" 
	} 

$MFAData=Get-MgUserAuthenticationMethod -UserId $user.UserPrincipalName #-ErrorAction SilentlyContinue 
$myobject.displayname = $user.displayname 
$myobject.user = $user.id; 
    #check authentication methods for each user 
    ForEach ($method in $MFAData) { 
        Switch ($method.AdditionalProperties["@odata.type"]) {     
          "#microsoft.graph.microsoftAuthenticatorAuthenticationMethod"  {  
            $<http://myObject.app|myObject.app> = $true  
            $myObject.MFAstatus = "Enabled" 
          }                            
        } 
    } 
	$results+= $myObject; 
} 
Write-Output "Authentication methods of users retrieved" 

foreach ($result in $results) 
{ 
    $name = $result.displayname 
	if ($result.MFAStatus -eq 'Enabled') 
	{ 
		Write-Output "User $name added to F_MFA-AuthenticatorEnabledUsers" 
		New-MgGroupMember -GroupId '[GROUPID]' -DirectoryObjectId $result.user -ErrorAction Ignore 
	} else { 
		Write-Output "User $name didn't configure MFA authenticator yet" 
	}	 
}

Do a manual test and when successful create a schedule for each moment you want it to run. Bind the schedules to the runbook.