External Identity for Azure VDI /Windows 365

Summary

The video explains how external identity can give contractors, vendors, or suppliers access to Azure Virtual Desktop (AVD) or Windows 365 Cloud PCs using their existing work identity. Instead of creating a separate account for each external user in the customer’s Microsoft Entra ID or Active Directory, the customer invites the user as a guest and assigns the required resources.

Requirements and limitations

• The session host must run a supported Windows 11 Enterprise build.
• The host must be Microsoft Entra joined; hybrid AD join is not supported.
• Single sign-on (SSO) must be enabled.
• Access is through the Windows app or a browser.
• FSLogix is not supported.
• The feature is available only in the Azure public cloud. Government and 21Vianet-operated clouds are not supported, and cross-cloud users are also unsupported.
• Kerberos authentication is not supported in this scenario. As a result, access to resources such as an on-premises file share that relies on Kerberos will not work.

Demonstration walkthrough

The presenter demonstrates a vendor user from one Entra tenant accessing a Cloud PC hosted in a customer tenant:

1. In the customer tenant, invite the vendor as an external guest using their existing email address.
2. Set the guest’s usage location, which the presenter notes is needed for license assignment.
3. Have the vendor accept the invitation using the provided invitation URL and their own account.
4. Create a group, add the guest, and target that group with a Windows 365 provisioning policy.
5. Configure the policy with a full desktop, Enterprise license type, Microsoft Entra join, a Microsoft-hosted network, and the selected region. Enable Microsoft Entra single sign-on.
6. Assign the required licenses. In the demonstration, the presenter assigns Microsoft 365 E3 and Windows 365 licenses for the Cloud PC. He says an Office 365 license is sufficient when using AVD without Windows 365.
7. Once provisioning is complete, sign in through the Windows app or browser. Choose Sign in to an organization, enter the customer tenant’s domain, and authenticate with the guest’s original vendor identity.

The demonstration ends with a successful Cloud PC sign-in. The device belongs to the customer tenant, while the signed-in user retains their identity from the vendor’s tenant.

Main speaker/source: Mohammed Kub, presenting on the VDIBuzz YouTube channel.