This message was deleted.

Can you give us more details on your environment ? How are you building your images, Citrix PVS, MCS, Stand alone ? Are you using KMS or MAK licenses ?

Images are built with MCS. We are using o365. When the users click sign in option in word, or any other office app, it prompts for their email then the sign in prompt never shows. We have set BlockAADWorkplaceJoin to 1 at the recommendation of MS.

are you Hybrid Azure AD Joined ?

Win 10 They are only Domain Joined and Azure PRT is set to No

that's your issue, it must be set to yes otherwise SSO will fail, that include Office, OneDrive, Teams, Edge

@Jonathan Pitre without having read all the CTX articles, are you really sure that machines need to be hybrid joined? I always follow this whitepaper from MS and SSO works for non hybrid joined machines afaik. The times when it has not, something in the setup between Azure and on prem has been wrong, i.e. missing azureadssoacc. https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-quick-start

So it seems like the issue was related to FSLogix getting stuck logging off due to WSearch getting stuck and the user's having multiple sessions. The issue was fixed by one of the following. • Updated Windows to OS Build 19004.2604 • set: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\office\16.0\Outlook\OST\NoOST:DWORD = 2 • Update FSLogix 2.9.8228.50276 > 2.9.8440.42104 • Enabled Windows Search Service and repaired Office (https://www.carlstalhood.com/vmware-horizon-8-master-virtual-desktop/#fslogixinstall) For FSLogix also had to enable RoamIdentity so users do not have to log into Office and OneDrive every login.

@Robert Berggren we are currently having the same conversation internally at ITI. In my experience Hybrid AD Joined totally works. I've seen other CTX blogs articles recommending it over the years to fix SSO issues. Hence why I started doing it in the first place. Can we avoid it and still achieve SS0 in 365 and Edge? that's something I need to verify myself. I'm all for KISS so if you get your MS apps to SSO without the extra complexity of HADDJ, go for it.