So, I had some free time this week so I dug into why AzurePRT was not working on newer versions of Server 2025 Insider and Windows 11. It all ties in to the retirement of ws-trust. I am working on a full write up on how to get this working again, but here is what I have so far. Server 2025 Vanilla is the last version that will work with WS-Trust. They disable it on Insider builds, but they also haven't enabled the Windows Hello for Business and it's usage of kerberos in the cloud like they have for Windows 11. If anyone has contacts with Microsoft and want to get them to accelerate that, or allow us to enable the fall back to ws-trust for RDP VDI style sessions, that would be great.

Interesting, Jeff. I thought ws-trust is only used in hybrid environments where there's an OnPrem IdP like ADFS? In hybrid environments with cloud sync / connect, I thought CBA via SCP to Entra is used?