Enable single sign-on for dev boxes
In this article, you learn how to enable single sign-on (SSO) for dev boxes in Microsoft Dev Box pools.
SSO allows you to skip the credential prompt when connecting to a dev box and automatically sign in to Windows through Microsoft Entra authentication. Microsoft Entra authentication provides other benefits including passwordless authentication and support for third-party identity providers. To get started, review the steps to configure single sign-on.
Prerequisites
- To enable SSO for dev boxes, you must configure single sign-on for your organization. For more information, see: Configure single sign-on for Azure Virtual Desktop using Microsoft Entra ID authentication.
Enable SSO for dev boxes
Single sign-on is enabled at the pool level. Dev Box supports single sign-on for dev box pools that use Microsoft Entra joined networks, and Microsoft hosted network, but not pools using Microsoft Entra hybrid joined networks.
When you enable SSO for a pool, all new dev boxes created from that pool use SSO. Existing dev boxes continue to use the existing sign-on method. You can enable single sign-on for dev boxes as you create a pool, or an existing pool.
Enable SSO when creating a new pool
To enable SSO for dev boxes as you create a pool, follow these steps:
Sign in to the Azure portal.
In the search box, enter projects.
In the list of results, select Projects.
Select the project in which you want to create the pool.
In the left menu, under Manage, select Dev box pools.
In the toolbar, select Create.
On the Create pool page, under Management, select Enable single sign-on.
Enter the remaining details for your new pool, and then select Create.
Enable SSO for an existing pool
To enable SSO for dev boxes in an existing pool, follow these steps:
Sign in to the Azure portal.
In the search box, enter projects.
In the list of results, select Projects.
Select the project that contains the pool you want to enable SSO for.
In the left menu, under Manage, select Dev box pools.
Select the pool that you want to enable SSO for.
On the line for the pool, at the right end, select ... and then select Edit.
On the Edit pool page, under Management, select Enable single sign-on, and then select Save.
Disable SSO for dev boxes
You can disable SSO for a pool at any time by deselecting the Enable single sign-on option on the Edit pool page.
To disable SSO for dev boxes in an existing pool, follow these steps:
Sign in to the Azure portal.
In the search box, enter projects.
In the list of results, select Projects.
Select the project that contains the pool you want to disable SSO for.
In the left menu, under Manage, select Dev box pools.
Select the pool that you want to disable SSO for.
On the line for the pool, at the right end, select ... and then select Edit.
On the Edit pool page, under Management, clear Enable single sign-on, and then select Save.
If you disable single sign-on for a pool, new dev boxes created from that pool prompt the user for credentials. Existing dev boxes continue to use SSO.
Understand the SSO user experience
When single sign-on is enabled for a pool, your sign-on experience is as follows:
The first time you connect to a dev box with single sign-on enabled, you first sign into your physical machine. Then you connect to your dev box from a remote desktop client like Windows App or the developer portal. When the dev box starts up, you must enter your credentials to access the dev box.
The next time you connect to your dev box, whether through the Windows App or through the developer portal, you don't have to enter your credentials.
If your connection to your dev box is interrupted because your client machine goes to sleep, you see a message explaining the issue, and you can reconnect by selecting the Reconnect button. You don't have to reenter your credentials.