Hi all! Have anyone managed to get SSO to work to an on-prem RDS environment from an Entra-ID only joined machine with WHFB? I cannot find a good answer researching it online.

It's been a few years, but this should work. I configured it with RDS 2019 back in the day and to my knowledge it was fairly straightforward. Remote Credential Guard | Microsoft Learn

I have tried that but will look again! Then I now know that it's possible at least. And you had the whole rdbroker/rdweb configured?

Yes complete setup with RD Broker and RD Web on separate hosts og multi RD Session Hosts

Cannot get it to work, unfortunately. Not sure why. Going cert based now instead, if that also is not working the will have to hybrid join there clients. :-)

Do you have Cloud Kerberos Trust configured?

Yes I have, I get a kerberos ticket from the domain controller. I know there is a problem with W11 24H2 but I am using a W10 for the moment so it SHOULD work. Do you recall if there was something that had to be done on the rdweb IIS site?

It's been a few years since a configured it, but I don't remember doing anything in IIS. I might have been using the HTML5 client though

I now believe it's a licensing issue - we have BP and from what I understand you need at least E3.

Ah yes, credential guard is a Windows Enterprise feature