Server 2025 RD Session Host + FSLogix + Office 365 logins with every connection

Green4all 20 Reputation points
2025-07-24T13:28:53.5266667+00:00

Hello,

We are currently setting up new RD session hosts (operating system Server 2025) which are combined into a farm.

The user profiles are provided on a local file server (Server 2025).

We are using FSLogix version 25.06 (error pattern identical to version 25.04) .

Office 365 version used (16.0.18925.20158 - 32-bit)

When setting up the servers under the new operating system, there were various errors at the start (“Session Key is empty” messages, etc.).

These have already been resolved with the following settings.

However, each user still has to log in to Microsoft applications every time they log in (even if their profile already exists). After successfully entering their username, password, and MFA, the following message appears during login (sorry for the german screenshot):

Benutzerbild

Once the user confirms this, they can work normally on the server in their session.

Is there anyone here who has had a similar experience and perhaps has a solution?

This cannot be a permanent solution.

Now the settings that were configured for FSLogix in the GPO:

Benutzerbild

The following is the content of redirections.xml:

<?xml version="1.0" encoding="UTF-8"?>

<FrxProfileFolderRedirection ExcludeCommonFolders="0">

<Excludes>

<Exclude Copy="0">AppData\Roaming\Microsoft\Protect</Exclude>

<Exclude Copy="0">AppData\Roaming\Microsoft\Credentials</Exclude>

<Exclude Copy="0">AppData\Local\Microsoft\Credentials</Exclude>

<Exclude Copy="0">AppData\Local\Microsoft\Office\16.0\OfficeFileCache</Exclude>

<Exclude Copy="0">AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState</Exclude>

<Exclude Copy="0">AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState</Exclude>

<Exclude Copy="0">AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState</Exclude>

<Exclude Copy="0">AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState</Exclude>

<Exclude Copy="0">AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy</Exclude>

<Exclude Copy="0">AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy</Exclude>

<Exclude Copy="0">AppData\Local\Microsoft\TokenBroker</Exclude>

</Excludes>

<Includes>

</Includes>

</FrxProfileFolderRedirection>

Microsoft 365 and Office | Install, redeem, activate | For business | Windows
Answer accepted by question author
Ryan-N 15,750 Reputation points Microsoft External Staff Moderator
2025-07-24T17:55:06.4533333+00:00

Hi @Green4all,

Thank you for sharing the issue encountered during the deployment of Remote Desktop Session (RDS) servers running Windows Server 2025, integrated with FSLogix v25.06 and Office 365 version 16.0.18925.20158 (32-bit).

After thorough analysis, we are pleased to provide detailed guidance to resolve the issue where users are prompted to sign in again each time they access an RDS session, including the device registration prompt with Azure AD.

  1. Enable RoamIdentity in FSLogix

Objective: Store Office 365 authentication tokens in the user profile to avoid repeated login prompts.

  1. Steps:
  • Configure the registry on each session host:
    • Path: HKEY_LOCAL_MACHINE\SOFTWARE\FSLogix\Profiles
    • Value name: RoamIdentity (REG_DWORD)
    • Value: 1
  • If using Group Policy, apply via ADMX or GPP.
  • Check the redirections.xml file to ensure the following folders are not excluded:
    • AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
    • AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy
    • AppData\Local\Microsoft\TokenBroker → If these entries exist under <Excludes>, remove or adjust them.
  • Restart or log off all user sessions to apply changes.

Expected Result: Users will only need to sign in once. Subsequent logins will automatically authenticate with Office 365.

  1. Block Automatic Azure AD Device Registration

Objective: Prevent the “Allow your organization to manage this device” prompt from appearing at each login.

Steps:

  • Configure the following registry on each session host:
    • Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin
    • Value name: BlockAADWorkplaceJoin (REG_DWORD)
    • Value: 1

Expected Result: The device registration prompt will no longer appear, improving user experience.

  1. Long-Term Solution: Integrate Azure AD for True Single Sign-On (SSO)

Option A: Hybrid Azure AD Join for RDS servers

  • Configure Azure AD Connect to enable Hybrid Join for the OU containing the servers.
  • Verify status using dsregcmd /status → Confirm AzureAdJoined: YES and presence of PRT.

Option B: Enable Azure AD Seamless SSO

  • Configure in Azure AD Connect → Create AZUREADSSOACC account and set SPNs.
  • Ensure Azure AD URLs are added to the “Local Intranet” zone via GPO.

Expected Result: When users log in with AD credentials, the system will automatically authenticate with Azure AD → Office 365 opens without requiring re-authentication.

  1. Additional Checks and Remediation
  • FSLogix Version: Ensure the latest version is used (v25.06 or newer if patched).
  • Clear old credentials (if needed): In special cases, delete the following folders:
    • %LOCALAPPDATA%\Microsoft\Credentials
    • %LOCALAPPDATA%\Microsoft\OneAuth → Only perform this if issues persist after applying the above steps.

Conclusion

By following these steps, you can:

  • Eliminate repeated login prompts for users.
  • Prevent disruptive device registration notifications.
  • Ensure seamless single sign-on (SSO) experience in the Windows Server 2025 RDS environment.

If you have any updates regarding the issue or other questions, please feel free to share them with me.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

User's image

Was this answer helpful?

1 person found this answer helpful.

2 additional answers

Sort by: Newest
Most helpful Newest Oldest
  1. Daniel Soenke 15 Reputation points
    2026-06-29T10:58:58.73+00:00

    Hallo Green4all - ich glaube wir haben/ hatten dasselbe Thema. Falls noch relevant für dich.

    Schau mal hier:

    https://learn.microsoft.com/en-us/answers/questions/5750595/58tm1-remote-desktop-server-farm-fslogix-25-09

    Stand jetzt läuft es mit der FSLogix 26.01 CU1 (critical update).

    Was this answer helpful?

    0 comments
  2. Green4all 20 Reputation points
    2025-09-21T08:32:29.9+00:00

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.