Guest user access lets you give people from outside a customer's organization, known as Microsoft Entra B2B guest users, access to Azure Virtual Desktop (AVD) desktops in that customer's account. Instead of creating an account in the customer's tenant for each outside person, you invite them as guests, assign them a desktop, and manage them next to the customer's other users.
With guest user access you can enable guest access for a customer account, invite guest users by email address, manage them on the Users page, and give them a seamless sign-in experience to Microsoft Entra joined host pools. It is intended for MSP and account administrators who need to provide desktops to contractors, partners, or other outside staff.
The tasks in this article are performed at the Account level.
|
Issue/limitation |
Impact |
Mitigation/planned fix |
|---|---|---|
|
Guest user access supports Microsoft Entra ID joined host pools only. |
Guest users cannot be given desktops in host pools that use other join types. |
Use Microsoft Entra ID joined host pools for desktops that guests need. |
|
Guest users that are assigned a desktop count as AVD users for Nerdio Manager licensing. |
Guests add to the number of AVD users that you are billed for. |
Review the guests that have desktops, and remove access that is no longer needed. |
The following Nerdio Manager roles allow you to manage guest user access:
-
Roles that can add and manage users, such as MSP Admins and Account Admins, can enable guest user access and manage guest users.
Following the Principle of Least Privilege (PoLP), you can define one or more Nerdio Manager custom role(s) with the access levels required to manage guest user access:
-
The access levels that allow users to add and manage users also apply to guest users. See Overview of users.
Guest user access is off by default. Enable it for each account that needs it.
To enable guest user access:
-
At the Account level, navigate to Settings > Integrations.
-
Scroll down to the User Management area.
-
Select the setting to enable guest user access.
-
In the confirmation dialog, confirm the change.
Result: guest user access is enabled for the account, Nerdio Manager has the extra permission it needs to send invitations, and single sign-on is turned on for the account's Microsoft Entra joined host pools.
To invite a guest user:
-
At the Account level, navigate to Entra > Users.
-
Select Invite User.
-
Enter the details of the guest user, including the email address, and send the invitation.
Result: the guest user appears on the Users page.
Manage a guest user in the same way as other users on the Users page: assign the guest user to a desktop, or add the guest user to a group that has desktop access. For the steps, see Overview of users.
Enabling guest user access also turns on single sign-on (SSO) for Microsoft Entra joined host pools, by setting the enablerdsaadauth RDP property, so that guests are not prompted for their credentials again when they connect. For background on SSO, see Configure Single Sign-On for Your Azure Virtual Desktop Environment.
Contact our Sales team for more information about this feature.
Raise a support ticket about this feature.
Comments (0 comments)