Connect Azure AD / Microsoft Entra ID to Windows Server RDP via OnePAM. Enforce Conditional Access, MFA, and session recording on every RDP connection — without Azure AD Premium NPS complexity.
Azure AD SSO for Windows RDP — Simplified
Microsoft Azure AD (now Microsoft Entra ID) is the identity platform for organizations using Microsoft 365, Azure, and hybrid Active Directory environments. While Azure AD provides excellent SSO for cloud applications via SAML and OIDC, extending that same SSO experience to Windows Server RDP is surprisingly complex. Microsoft's native approach requires Azure AD Premium P1/P2 licensing, NPS (Network Policy Server) with the Azure MFA extension, RADIUS configuration, and RD Gateway — a multi-component architecture that's difficult to deploy, debug, and maintain. OnePAM provides a dramatically simpler alternative. OnePAM integrates with Azure AD / Entra ID as a standard SAML 2.0 or OIDC application, leveraging your existing Conditional Access policies, MFA requirements, and group-based access controls. Users authenticate via their familiar Azure AD login (with Authenticator push, FIDO2 key, or any MFA method) and OnePAM brokers the RDP session — via local agent or gateway RDP proxy. No NPS, no RADIUS, no RD Gateway complexity.
Local Agent
Install the OnePAM agent on each Windows server. The agent intercepts RDP authentication and enforces SAML/OIDC SSO with Kerberos and Protected User support before granting desktop access — no gateway required.
Gateway RDP Proxy
Run a dedicated OnePAM gateway with native RDP protocol support. Users authenticate via SAML/OIDC at the gateway, which brokers the RDP session using Kerberos NLA. No agent needed on target servers.
Why Azure AD + RDP Is Hard Without OnePAM
Without identity-based RDP access, these risks threaten your Windows servers every day.
RDP Security Challenges
These are the risks organizations face with traditional RDP authentication.
NPS/RADIUS Complexity
Microsoft's native RDP MFA requires NPS, RADIUS, Azure MFA extension, and RD Gateway — a four-component architecture that's complex to deploy and maintain.
Conditional Access Gap
Azure AD Conditional Access policies control access to cloud apps, but they don't natively apply to RDP sessions on Windows servers.
Azure AD Premium Required
The NPS MFA extension requires Azure AD Premium P1 or P2 licensing, adding cost on top of the deployment complexity.
No Session Recording
Even with Azure AD + NPS + RD Gateway, there's no native session recording. You need a separate PAM solution for visual audit trails.
Hybrid Identity Complexity
Organizations with hybrid AD (on-prem + Azure AD) face additional challenges synchronizing identities and applying consistent RDP policies.
Limited to Azure MFA
The NPS approach only works with Azure AD's built-in MFA. Third-party MFA solutions (Duo, FIDO2 keys via non-Microsoft flows) aren't supported.
How OnePAM Connects Azure AD to RDP
Step-by-step guide to deploying identity-based Windows RDP access.
Register OnePAM in Azure AD
Add OnePAM as an Enterprise Application in Azure AD / Entra ID with SAML 2.0 or OIDC configuration.
Apply Conditional Access Policies
Use your existing Azure AD Conditional Access policies to control RDP access — device compliance, location, risk level, MFA requirements.
Choose Agent or Gateway
Install the OnePAM agent on Windows servers for direct SSO, or deploy a gateway RDP proxy for agentless coverage.
Map Azure AD Users to Windows Accounts
Map Azure AD UPN or email to Windows domain accounts for RDP session establishment.
Enable Session Recording and Auditing
Activate visual RDP session recording and centralized audit logging with Azure AD identity context.
Benefits of Azure AD SSO for RDP via OnePAM
Measurable security and operational outcomes from deploying OnePAM Windows RDP SSO.
No NPS/RADIUS Required
Eliminate the NPS, RADIUS, and Azure MFA extension stack. OnePAM connects Azure AD to RDP via standard SAML/OIDC — no middleware.
Zero NPS infrastructureConditional Access for RDP
Apply your existing Azure AD Conditional Access policies to RDP sessions — device compliance, location, risk level, and MFA strength.
Full Conditional Access coverageWorks with Azure AD Free/P1
OnePAM uses standard SAML/OIDC, which works with Azure AD Free (with limitations) and Azure AD Premium P1. No P2 required for basic RDP SSO.
Lower licensing costsVisual Session Recording
Add session recording to RDP — a capability that Azure AD + NPS + RD Gateway cannot provide natively.
Built-in visual recordingsUnified Audit with Cloud Apps
RDP access events appear alongside Azure AD sign-in logs and OnePAM's centralized audit trail.
Single audit platformDeploy in Minutes, Not Days
Azure AD enterprise app registration + OnePAM deployment takes minutes. NPS + RADIUS + RD Gateway takes days or weeks.
Minutes vs. daysWindows RDP SSO Capabilities
Every feature needed for enterprise-grade Windows RDP authentication.
Zero-Day Protection Features
Enterprise-grade security controls for RDP access.
Azure AD RDP SSO Use Cases
Common scenarios where organizations deploy OnePAM Windows RDP SSO.
Azure AD / Entra ID RDP SSO FAQ
Common questions about Windows RDP SSO and zero-day protection.
How is OnePAM different from Azure AD + NPS for RDP MFA?
Do I still need Azure AD Premium?
Can OnePAM use Microsoft Authenticator for MFA?
Does this work with Azure AD hybrid join?
Connect Azure AD to RDP — Without NPS Complexity.
Use your existing Azure AD / Entra ID identity for RDP SSO. Apply Conditional Access, enforce MFA, and record sessions — deployed in minutes.