Single Sign-On (Beta)

Single Sign-On signs users in to Windows on their workstation with their Microsoft Entra account when they connect. Users do not type a Windows password.

It also unlocks a locked desktop, takes a user to their own desktop if someone else is signed in, and signs them back in after a restart.

Requirements

• Setup requires a Microsoft Entra Global Administrator, or an account holding both Privileged Role Administrator and Application Administrator.
• Each workstation must be joined to Microsoft Entra, or hybrid joined, in your organisation’s directory.
• Each workstation must have a TPM 2.0. A virtual TPM works.
• Each workstation must run Remotle host 2026-10-11-2304 or later.

---

Connect Microsoft Entra

1. Open Users, Single Sign-On.

2. Choose the Single Sign-On group:

   • Use an existing security group. You choose it from your directory after the Microsoft sign-in. Direct members only.
   • Create a Computle group. Computle keeps its members equal to your organisation’s active users.

3. Read the list of changes Connect makes in your directory (below).

4. Tick the agreement and click Connect Microsoft Entra.

   A Microsoft sign-in window opens. If your browser blocks it, allow pop-ups for the portal and try again.

5. Sign in and grant consent.

---

Changes Connect makes in your Microsoft Entra directory

1. Adds an application registration named Computle Identity, with these Microsoft Graph application permissions: read all users (User.Read.All); read and change group membership (GroupMember.ReadWrite.All); read and change the authentication methods policy (Policy.ReadWrite.AuthenticationMethod); read and change the certificate-based authentication trust store (PublicKeyInfrastructure.ReadWrite.All); manage the applications it owns (Application.ReadWrite.OwnedBy).
2. Adds a certificate-based authentication trust store entry, named Computle logon followed by your organisation’s Computle identifier, holding the Computle logon root and intermediate certificates and their revocation list address.
3. Enables the X.509 certificate authentication method for the Single Sign-On group only; adds a PrincipalName to userPrincipalName certificate binding; adds a certificate authority scope limiting the Computle logon certificate authority to that group.
4. If you chose Create a Computle group, adds that security group. If you chose an existing group, its members are not changed.

Disconnect removes the application, the trust store entry, and the group’s target and certificate authority scope from the X.509 method. No group is removed.

---

Conditional Access and multifactor authentication

Microsoft Entra counts the Computle sign-in certificate as single factor, so a Conditional Access multifactor requirement blocks silent sign-in. In Microsoft Entra, Authentication methods, Certificate-based authentication, set the rule for the Computle logon CA to multifactor.

Single Sign-On does not change your Conditional Access policies.

---

Check each workstation

Open Users, SSO diagnostics. The page checks your organisation’s setup, then each workstation:

Check	If it fails
Host version	Update the Remotle host to 2026-10-11-2304 or later.
TPM	No TPM: give the workstation a TPM 2.0. Not ready: initialise the TPM in Windows (tpm.msc).
Sign-in card	Restart the Computle Broker service on the workstation.
Microsoft Entra	Domain only: the workstation needs hybrid join through Entra Connect. Workgroup: join the workstation to Microsoft Entra.
Last silent sign-in	Shows the result of the last attempt, or the reason Windows refused it.