Entra SSO for DaaS - anybody know if this can be introduced to an existing DaaS tenant for testing on a test Delivery Group without affecting existing users and DGs? I already have most of the configuration in place for other\existing purposes - mostly just need to create the Entra apps by the looks of things and don't want to affect existing users. W2025, hybrid-joined.

If the vdis are already on the required OS and vda level, keep\change the primary dg's machinelogontype property as 'ActiveDirectory'. Create a new DG with machine logontype as 'HybridAzureAD' and move test users and vdis to it. Register the apps and ask the users to logon. Only the one's on new DG should be able to SSO

Thanks - yes can confirm this seems to work well in initial testing. The Windows lock screen in Citrix has been our final hurdle for full passwordless... :)

Fingers crossed. We were advised to disconnect the session instead of lockscreen (like in AVD)

Yes the disconnect vs lock is the key, with the sso reconnect. It seems to work as described - which is refreshing!

What technically also works (for single session OS) is this policy on the VDA: