Overview

Active Directory Federation allows users from a primary (corporate or MSP) TruGrid domain to connect to hosts in a customer domain using Single Sign-On (SSO). The user does not need to know or manage credentials for the customer domain. TruGrid handles account creation and authentication automatically.

This feature is designed for MSP environments where technicians or corporate staff need seamless access to customer RDS hosts, and for organizations managing multiple subsidiary or customer AD domains through a single TruGrid account.

Active Directory trusts are not required

TruGrid achieves cross-domain access by provisioning a dedicated shadow account inside the customer domain's Active Directory and managing that account's credentials internally. Because the authenticating account already resides in the customer domain, there is no cross-forest authentication to validate and therefore no trust to establish.

If you are looking for the ability to have a single TruGrid Sentry enumerate multiple domains within one Active Directory forest, that is a separate feature. See How to configure TruGrid SecureRDP for Hybrid Authentication for the DomainsIncludedInAdSearch registry configuration.

How It Works

1. An admin assigns a primary domain user to a customer domain via the Active Directory Federation page in TruGrid.
2. TruGrid automatically creates a shadow account, prefixed with TG-, in the customer domain's Active Directory.
3. The primary domain user does not know the shadow account password. TruGrid manages it internally.
4. When the user connects to a customer domain host through the TruGrid Windows Connector App or Web Portal, TruGrid sends a push notification to the TruGrid Authenticator app.
5. Once the user approves the notification, the RDP session opens automatically with no credential prompt.

Requirements

TruGrid Configuration

• Primary domain must be connected to TruGrid (on-premises AD or Entra ID)
• Customer domain must be connected to TruGrid as an active customer domain
• A TruGrid Sentry must be installed and reporting in the customer domain
• Target host must be online and visible in the customer domain workspace
• User must be assigned to the customer domain via Company > Active Directory Federation. Assigning a user as an administrator via Roles Management is a different function and will not provision a shadow account or enable SSO.

Service Account Permissions

The TruGrid service account (TG-ServiceAccountv2) in the customer domain must be delegated control to:

• Create and delete user accounts
• Manage group membership

Active Directory Federation assignments can only be made to individual users. Group-based assignment is not supported, and pooled resources do not affect Federation assignments. Plan accordingly when onboarding a large technician roster.

User Device

• TruGrid Authenticator app must be installed and enrolled on the user's mobile device
• The user must complete Authenticator enrollment before attempting an SSO connection
• The device requires an active data connection at the time of connection, since Push Authentication cannot be delivered offline

Setup Steps

Step 1 - Assign a User to a Customer Domain

1. Log into the TruGrid portal as a Company Admin
2. Go to Company > Active Directory Federation
3. Find the primary domain user you want to assign
4. Click the user and assign them to the target customer domain
5. Save the assignment

TruGrid will automatically create the shadow account in the customer domain's AD. Allow a few minutes for the account to provision.

Step 2 - Verify Shadow Account Creation

On a domain controller in the customer domain, confirm the account was created:

Get-ADUser -Filter "Name -like 'TG-*'" -Properties UserPrincipalName |
    Select-Object Name, SamAccountName, UserPrincipalName, Enabled

If you are running this from a different domain, add -Server <customerdomain>.
An account should be returned with a TG- prefix. If Enabled is False, or if no account is returned at all, see Troubleshooting below.

Step 3 - Enroll TruGrid Authenticator

1. The user logs into the TruGrid portal or Desktop App
2. Set up MFA with TruGrid Authenticator as the MFA method
3. Follow the enrollment steps to link the Authenticator app to the account

If the user already has MFA configured with a different method, reset their MFA first. See How Admins can manage MFA.

Step 4 - Test the Connection

1. Log into the TruGrid Windows Connector using the primary domain credentials (for example username@maindomain.com)
2. Navigate to Customer Domains and select the target customer domain
3. Click the target host to initiate a connection
4. A push notification will appear on the TruGrid Authenticator app
5. Approve the notification
6. The RDP session opens with no credential prompt. SSO confirmed.

Troubleshooting

Notes

• The shadow account password is managed entirely by TruGrid. Admins and users should not attempt to change or reset it manually.
• Do not manually delete, disable, rename, or move shadow accounts. Manage them only through the Active Directory Federation page in the TruGrid portal.
• This feature provides access from a primary domain into a customer domain. It does not provide the reverse.
• Active Directory trusts are neither required nor used by this feature. See the section above.

Related Articles

• Setting up MFA using TruGrid Authenticator
• How Admins can manage MFA
• Minimum Permissions Required for TruGrid Service Account (TG-ServiceAccountv2)
• How to configure TruGrid SecureRDP for Hybrid Authentication
• How to Configure TruGrid SecureRDP to Authenticate against On-Premise AD
• Add New Customer Domain in Multitenant Dashboard
• How to add an additional Service Provider Administrator
• TruGrid Sentry Installation and Update Guide

Updated on: 18/08/2026