> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.trugrid.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# TruGrid SecureRDP - SSO Plugin guide

## Overview

The TruGrid SSO Plugin is a component of the TruGrid Windows Connector. It lets users sign in to their Entra ID joined or Microsoft Entra hybrid joined devices over TruGrid SecureRDP using their Entra ID (Microsoft 365) credentials.

| This article is for administrators: what the plugin does, what each environment needs, and how to deploy it. End users only need the Connector itself, see [TruGrid Desktop Connector for Windows Setup](https://help.trugrid.com/en/article/trugrid-desktop-connector-for-windows-setup-1rgzxud/).


## How it works

The SSO Plugin is a Windows service. It adds the hostname of the host device to the local Windows hosts file, which allows modern (Entra ID) authentication to be triggered for the RDP connection.
* **It can be disabled.** The service can be stopped or disabled like any other Windows service. SSO relies on it, so disabling it turns SSO off on that machine.
* **Whitelist it in your EDR.** The plugin must be allowed in any EDR or endpoint security product on the Connector machine. If it is blocked, SSO will not work properly.

## What you need

| Environment | Requirements |
| ---- | ---- |
| Entra ID only (serverless) | SSO Plugin installed, and the Entra ID user added to the target's remote users. See [How to RDP to an Azure AD joined machine](https://help.trugrid.com/en/article/how-to-rdp-to-an-azure-ad-joined-machine-y1kzzt/). No further setup. |
| Hybrid (on-premises AD synced to Entra ID) | SSO Plugin installed, targets hybrid joined, and Entra Kerberos configured in your AD and Entra ID tenant. [Full setup here.](https://help.trugrid.com/en/article/how-to-enable-sso-auth-to-on-premises-resources-with-entra-id-1jrefau/)  |
| On-premises AD only | Not supported. |

In all environments, the SSO Plugin service must be running on the machine running the Connector, and that machine must run Windows 10 version 2004 or later.
### Hybrid environments

Hybrid SSO depends on Microsoft Entra Kerberos, which lets Entra ID issue Kerberos tickets for your on-premises AD domain. Setting it up is a one-time task per AD domain: enable passkeys (FIDO2) in the tenant, then create and publish an Entra Kerberos server object with PowerShell. Domain controllers must run Windows Server 2016 or later, and target devices must show both **AzureAdJoined** and **DomainJoined** as **YES** in `dsregcmd /status`.

| The full prerequisites and step-by-step commands are in [How to Enable SSO Auth to On-Premises resources with Entra ID](https://help.trugrid.com/en/article/how-to-enable-sso-auth-to-on-premises-resources-with-entra-id-1jrefau/).

## Install the SSO Plugin

The plugin requires administrative rights to install.
**Interactive.** The Connector installer asks whether to install the SSO Plugin and prompts for admin credentials. Tick the option and approve the prompt.

![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/win222_frz5to.gif)

**Silent and mass deployment.** Add `SSOPlugin=1` to the installer command line (default `0`, plugin not installed):
```
TruGrid_Windows_Connector_<version>.exe /quiet PERMACHINE=1 SSOPlugin=1
```
Intune, GPO, RMM and PowerShell remoting examples are in [TruGrid Windows Connector - Machine Wide installer](https://help.trugrid.com/en/article/trugrid-windows-connector-machine-wide-installer-javeb5/).

## End user experience

Users sign in to the TruGrid Windows Connector with their Microsoft 365 account, then connect to their device with their Entra ID credentials. The first connection to each device shows a prompt to allow the connection; it appears only once.

![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/sssso_c17pz4.gif)
## Limitations

* Accounts with high-level AD administrative access (Domain Admins and similar) cannot use SSO. They get a login loop when attempting it.
* If SSO does not work at all, first confirm the SSO Plugin service is running on the Connector machine.