Skip to content
remotledocsComputle Docs

Single Sign-On

Troubleshooting

If a sign-in fails

Section titled “If a sign-in fails”

Users see the normal Windows sign-in screen and sign in with their password. Nothing is locked, and the session continues.

CauseWhat to check
The user’s account is in another directoryThe account must be in the directory you connected.
The workstation is not in the device groupSSO diagnostics, Device group column.
The workstation is joined only to a domain, or to no directorySSO diagnostics, Microsoft Entra column.
Windows is older than the required buildSSO diagnostics, Windows build column.
A policy blocks the sign-in packageSSO diagnostics, LSASS policy column, and Policies that stop it working.
A Conditional Access policy blocked itLast single sign-on in SSO diagnostics, and the Microsoft Entra sign-in logs.
The user closed the Microsoft sign-in window in their browserAsk them to connect again and complete the sign-in.
The account is disabled or locked in Microsoft EntraThe user in Microsoft Entra.
Single sign-on is Off for the userClient settings, Device features, Per-user exceptions. See Device Features.

Check the connection

Section titled “Check the connection”

Open Users, Single Sign-On. Connected must show Yes and Entra authentication for Remote Desktop must show Enabled. The Last error row shows the most recent problem Computle met in your directory, with its time. A Reconnect needed badge means the connection must be made again with an administrator sign-in; the button reads Reconnect Microsoft Entra.

The Single Sign-On tab once connected, showing Connected, Enabled, the approved client app, the device group with seven devices, who agreed, and an empty Last error row

Check each workstation

Section titled “Check each workstation”

Open Users, SSO diagnostics. The page checks your organisation’s connection, then each workstation:

SSO diagnostics: the organisation's connection at the top, then one row per workstation with a pass or fail for each check and what to fix

Each failed check shows what to fix in red beneath it. The heading counts how many workstations are blocked and how many have not reported yet.

Three rows of SSO diagnostics: one workstation with an old Windows build, one whose LSASS policy is Not allowed, and one in a workgroup, each with the fix shown under the failed check

CheckIf it fails
Host versionUpdate the Remotle host.
Microsoft EntraDomain only: the workstation needs hybrid join through Entra Connect. Workgroup: join the workstation to Microsoft Entra.
Windows buildUpdate Windows to 11 24H2 with KB5065789 or later, or Windows Server 2025 with KB5073379 or later.
LSASS policyEnable “Allow Custom SSPs and APs to be loaded into LSASS” in Intune or Group Policy, or leave it Not configured.
Device groupAdd the workstation to the Single Sign-On device group in Microsoft Entra. With the Computle group, this happens once the workstation reports its Microsoft Entra join.
IntuneShown for information.
Last single sign-onShows the result of the last attempt, or the reason Windows refused it.

A workstation showing “Not reported” in every column has not sent its readiness yet. It reports when the Remotle host starts and after each change.

Type in Search machines… to find one workstation by name.

Section titled “Related”