Administration
Single Sign-On (Beta)
Single Sign-On signs users in to Windows on their workstation without a password. A user signs in to the Remotle app with their Microsoft work account and connects. The app obtains a Microsoft sign-in ticket for that workstation, and Windows on the workstation checks the ticket with Microsoft and signs the user in. The user gets a full Microsoft session, so single sign-on to Microsoft 365 works inside the desktop.
It also unlocks a locked desktop, takes a user to their own desktop if someone else is signed in, and signs them back in after a restart.
This is the model Microsoft Entra provides for remote desktop sign-in, and the same one other remote desktop products use. Nothing changes about how your users sign in on their own devices.
This page is for the IT administrator or security reviewer who approves the setup. Read it before you click Connect Microsoft Entra.
How a sign-in works
Section titled “How a sign-in works”- The user signs in to the Remotle app with Sign in with Microsoft and connects to a workstation.
- The workstation sends the app a single-use challenge that names the workstation.
- The app asks Microsoft Entra for a sign-in ticket for that workstation. The ticket is bound to a key that is made in the user’s device key store and never leaves it, so it cannot be used from another device.
- The app sends the ticket to the workstation. Windows passes it to Microsoft Entra, which checks the key, the workstation and the user.
- Windows signs the user in with a full Microsoft Entra session.
The ticket is for one workstation and is checked against the challenge it was issued for. No password is read, stored or sent, and no certificate is issued.
One Remotle sign-in is all a user does: their desktops open signed in. A Microsoft window appears only if your organisation’s policy asks them to sign in again, and then in their normal browser on their own computer, never on the workstation.
Requirements
Section titled “Requirements”Your directory
Section titled “Your directory”| Requirement | |
|---|---|
| Who connects | A Microsoft Entra account holding Application Administrator (or Cloud Application Administrator) and Groups Administrator. Global Administrator also works and is not required. |
| How users sign in to Remotle | With Sign in with Microsoft, using an account in the directory you connect. Users who sign in to Remotle with an email and password get the normal Windows sign-in screen. |
Each workstation
Section titled “Each workstation”| Requirement | |
|---|---|
| Directory join | Joined to Microsoft Entra, or hybrid joined, in the directory you connect. A workstation joined only to an on-premises domain cannot use Single Sign-On. |
| Windows | Windows 11 24H2 with KB5065789 (build 26100.6725) or later, or Windows Server 2025 with KB5073379 (build 26100.32230) or later. |
| Device group | A member of the Single Sign-On device group (see The device group). |
Policies that stop it working
Section titled “Policies that stop it working”Check your Group Policy and Intune configuration profiles for these settings before you connect:
| Setting | Effect | What to do |
|---|---|---|
| Allow Custom SSPs and APs to be loaded into LSASS (Local Security Authority) set to Disabled | Windows cannot accept the sign-in ticket. | Leave the setting Not configured, or set it to Enabled. |
| Always prompt for password upon connection (Remote Desktop Session Host, Security) set to Enabled | Windows asks for a password instead of signing in. | Set it to Not configured or Disabled. |
Exclude credential providers (System, Logon) listing the Computle Credential Provider, {86298202-B2EE-44AE-A354-A1CE4A2E5C26} | Windows never shows the Single Sign-On sign-in. | Remove that identifier from the list. |
The SSO diagnostics page in the portal shows the join state, Windows build, policy and device group of every workstation (see Check each workstation).
The Remotle app
Section titled “The Remotle app”Single Sign-On runs from the Remotle app on Mac, Windows and iPad. A user connecting from another client gets the normal Windows sign-in screen.
What Connect changes in your directory
Section titled “What Connect changes in your directory”Connect opens one Microsoft window with two consent screens. The first is for the Computle Single Sign-On Setup application: the administrator signs in and grants it delegated permissions, Computle uses that sign-in once to make the changes below, then discards it. The second approves the Microsoft Remote Desktop sign-in permission for the Computle sign-in application your users already use, Computle OAuth 2.0 (Portal Login), for all users of your directory. No new application is added for users. Nothing keeps administrator rights in your directory afterwards, and Computle holds no credential in it.
1. The Remote Desktop sign-in permission for the Computle sign-in application
Section titled “1. The Remote Desktop sign-in permission for the Computle sign-in application”Computle OAuth 2.0 (Portal Login) is the application every Remotle app and the Computle portal already sign your users in with. It is registered by Computle (verified publisher Computle LTD), is the same for every organisation, and is already in your directory as an enterprise application if any of your users has signed in. It holds no application permissions and no credential; it is a public client. Connect adds no application for users. It asks the administrator to approve one delegated permission for it, for all users:
| Permission | What it allows |
|---|---|
Microsoft Remote Desktop, sign in (user_impersonation) | Obtain a sign-in ticket for a workstation on behalf of the signed-in user. |
The permissions the application already has for signing users in are not requested again and are not changed.
Microsoft names the permission “Microsoft Remote Desktop” because that is the name of Microsoft’s sign-in service for remote desktops; Remotle never uses the Remote Desktop protocol.
2. Microsoft Entra authentication for Remote Desktop
Section titled “2. Microsoft Entra authentication for Remote Desktop”On the Microsoft Remote Desktop service principal in your directory (added if it is not there yet), Connect:
| Enables | Microsoft Entra authentication for Remote Desktop, if it is not already on. |
| Approves | Computle OAuth 2.0 (Portal Login) as a client application, so Microsoft Entra issues it sign-in tickets for your workstations. |
| Targets | The device group below, so your users are not asked to allow each connection. |
3. The device group
Section titled “3. The device group”A security group of the workstations Single Sign-On applies to, either:
- Computle session hosts, a security group Connect creates. Computle keeps its members equal to your Computle workstations that are joined to Microsoft Entra.
- An existing security group you choose from your directory after the Microsoft sign-in. Computle reads it and never changes its members.
The Setup application’s permissions
Section titled “The Setup application’s permissions”The Computle Single Sign-On Setup application asks for these delegated Microsoft Graph permissions, used once with the administrator’s sign-in and discarded:
| Permission | Used for |
|---|---|
User.Read | Record who agreed to the changes. |
Application.ReadWrite.All | Add the Microsoft Remote Desktop enterprise application to your directory if it is not there, and the Computle sign-in application if no user has signed in yet. |
Application-RemoteDesktopConfig.ReadWrite.All | The remote desktop configuration on the Microsoft Remote Desktop service principal. |
Group.ReadWrite.All | Create the Computle session hosts group and its members, or read the group you choose. |
AppRoleAssignment.ReadWrite.All | Requested with the others; not used by Connect. |
What Connect does not change
Section titled “What Connect does not change”| Users’ sign-in methods | No authentication method is added, enabled or changed. No certificate authority is added. Sign-in on users’ own devices is unchanged. |
| Conditional Access | No policy is read or written. |
| Multifactor authentication | No MFA setting, authentication strength or third-party MFA configuration is read or written. |
| Other applications and users | Nothing else in your directory is read or written. |
| Application permissions | None are granted. Computle holds no credential in your directory. |
Connect
Section titled “Connect”Open Users, Single Sign-On in the Computle portal.
-
Choose the device group.
Create a Computle device group makes Computle session hosts and keeps it current. Use an existing security group lets you pick one of your own after the Microsoft sign-in.
-
Read the list of changes and agree to it.
The page lists what Connect changes in your directory. Tick I am a Microsoft Entra administrator for this organisation and I agree to these changes.
-
Click Connect Microsoft Entra.
A Microsoft window opens. Allow pop-ups for the portal if your browser blocks it. Sign in with the administrator account and accept both consent screens. If you chose an existing group, pick it when the portal asks.
The page then shows the connection: whether Microsoft Entra authentication for Remote Desktop is on, the approved client application, the device group and the number of devices in it, and who agreed to the changes.
The sign-in must be completed within ten minutes. If it expires, start the connection again.
The device group
Section titled “The device group”Single Sign-On applies to the workstations in the device group. A workstation outside it gets the normal Windows sign-in screen.
| Computle session hosts | Existing security group | |
|---|---|---|
| Members | Your Computle workstations that are joined to Microsoft Entra. Computle adds a workstation when it is set up and removes it when it is retired. | Controlled by you in Microsoft Entra. |
| Changes by Computle | Membership only. | None. |
| Change later | Click Change group on the Single Sign-On page to move to one of your own groups. The Computle group stays in your directory for you to keep or delete. | The same. |
The group must be a security group. Nested groups are not included.
Conditional Access and multifactor authentication
Section titled “Conditional Access and multifactor authentication”Your Conditional Access policies apply to the sign-in as they do to any Microsoft Entra sign-in. The sign-in is to the Microsoft Remote Desktop resource, from the Remotle app on the user’s device, for the user’s account.
If a policy requires interaction, a Microsoft sign-in window opens in the user’s normal browser on their own computer. If a policy blocks the sign-in, or the user closes the window, the user sees the normal Windows sign-in screen and signs in with their password. Single Sign-On never changes a policy and never bypasses one.
Disconnect
Section titled “Disconnect”Click Disconnect on the Single Sign-On page. It removes what Connect created, in reverse order:
- The device group’s entry and the Computle OAuth 2.0 (Portal Login) approval on the remote desktop configuration. Microsoft Entra authentication for Remote Desktop is turned off only if Connect turned it on, and the configuration is deleted only if Connect created it.
- The Remote Desktop sign-in permission approved for Computle OAuth 2.0 (Portal Login). The application itself stays, as your users sign in with it.
No group is removed: a group you chose was never Computle’s, and the Computle session hosts group stays for you. The Microsoft Remote Desktop service principal stays. Users’ sign-in methods, Conditional Access policies and multifactor authentication settings are not touched.
Disconnect needs an administrator sign-in to make the changes in your directory, and asks for one if it has none.
If a sign-in fails
Section titled “If a sign-in fails”Users see the normal Windows sign-in screen and sign in with their password. Nothing is locked, and the session continues.
| Cause | What to check |
|---|---|
| The user signed in to Remotle with an email and password | Ask them to sign in with Microsoft. |
| The user’s account is in another directory | The account must be in the directory you connected. |
| The workstation is not in the device group | SSO diagnostics, Device group column. |
| The workstation is joined only to a domain, or to no directory | SSO diagnostics, Microsoft Entra column. |
| Windows is older than the required build | SSO diagnostics, Windows build column. |
| A policy blocks the sign-in package | SSO diagnostics, LSASS policy column, and Policies that stop it working. |
| A Conditional Access policy blocked it | Last single sign-on in SSO diagnostics, and the Microsoft Entra sign-in logs. |
| The user closed the Microsoft sign-in window in their browser | Ask them to connect again and complete the sign-in. |
| The account is disabled or locked in Microsoft Entra | The user in Microsoft Entra. |
Check each workstation
Section titled “Check each workstation”Open Users, SSO diagnostics. The page checks your organisation’s connection, then each workstation:
| Check | If it fails |
|---|---|
| Host version | Update the Remotle host. |
| Microsoft Entra | Domain only: the workstation needs hybrid join through Entra Connect. Workgroup: join the workstation to Microsoft Entra. |
| Windows build | Update Windows to 11 24H2 with KB5065789 or later, or Windows Server 2025 with KB5073379 or later. |
| LSASS policy | Enable “Allow Custom SSPs and APs to be loaded into LSASS” in Intune or Group Policy, or leave it Not configured. |
| Device group | Add the workstation to the Single Sign-On device group in Microsoft Entra. With the Computle group, this happens once the workstation reports its Microsoft Entra join. |
| Intune | Shown for information. |
| Last single sign-on | Shows the result of the last attempt, or the reason Windows refused it. |
Questions
Section titled “Questions”Does Single Sign-On store or send passwords?
Section titled “Does Single Sign-On store or send passwords?”No. It signs in with a single-use ticket from Microsoft Entra. No password is read, stored or sent.
Does it work with multifactor authentication?
Section titled “Does it work with multifactor authentication?”Your Conditional Access policies decide. See Conditional Access and multifactor authentication.
Can several users use one workstation?
Section titled “Can several users use one workstation?”Yes. Each sign-in is a ticket for that user, bound to a key on that user’s device. If someone else is signed in, the user is taken to their own desktop.
Should I use an existing security group, or create a Computle group?
Section titled “Should I use an existing security group, or create a Computle group?”Both work. You can change the group later. See The device group.
Will turning on Single Sign-On affect users who connect with Computle Client v3?
Section titled “Will turning on Single Sign-On affect users who connect with Computle Client v3?”No. A Computle Client v3 connection never triggers Single Sign-On, and those users sign in with their password as today.
Can Single Sign-On lock users out?
Section titled “Can Single Sign-On lock users out?”No. Connect adds no sign-in method and removes none. If a Single Sign-On attempt fails, the normal Windows sign-in screen stays and the user signs in with their password.
Does it change how users sign in to Microsoft 365 on their own devices?
Section titled “Does it change how users sign in to Microsoft 365 on their own devices?”No. Nothing about users’ sign-in methods changes. A user’s own laptop or phone signs in exactly as before.
Will users see a Microsoft sign-in window when they connect?
Section titled “Will users see a Microsoft sign-in window when they connect?”Normally not. The Remotle app obtains the sign-in ticket from the Microsoft sign-in the user already completed in the app, and renews it silently afterwards. A Microsoft window appears only if your organisation’s policy asks the user to sign in again, for example under a Conditional Access policy, and then it opens in their normal browser on their own computer, so sign-in tools such as Duo Desktop work as they do everywhere else. It never opens on the workstation.
Does it change anything on the workstation?
Section titled “Does it change anything on the workstation?”No. The Remotle host already includes the Computle Credential Provider. It shows nothing unless a Single Sign-On connection is signing someone in, and does not hide other sign-in options.