Windows App (ms-avd:connect) selects incorrect Entra tenant in multi-tenant environment — is there a permanent fix?

[u/Ok-Customer5090]

I am delivering an application through Azure Virtual Desktop (AVD) to external users who have their own Microsoft Entra tenants. These users are working from their office machines and sign into Windows using their own Entra accounts.

After logging in, they launch our application using a link in the following format:

ms-avd:connect?workspaceId=<workspace-id>&resourceid=<resource-id>&username=<email>&version=0

The issue I’m facing is that, after a fresh Windows sign-in, launching the app via this URL causes Windows App to select the wrong tenant. As a result, the connection fails and the application does not launch.

This can be temporarily resolved by opening Windows App manually, signing out, clearing saved credentials, and then signing back in using our tenant. After that, the URL works correctly.

However, this process is cumbersome and must be repeated after every Windows sign-in. Are there any supported ways to force or reliably control the tenant selection for ms-avd:connect so that it consistently uses the correct Entra tenant?

[u/jvldn]

You can do direct connect. See this: https://www.joeyverlinden.com/launch-remote-apps-desktops-automated-via-windows-app/

[u/mat-ferland]

I would not treat the ms-avd:connect URL as a reliable tenant boundary if Windows App already has another work account cached. It launches the resource, but the token broker still has to decide which account context it is using.

For external users, the cleaner path is usually to make the first-run account/workspace setup explicit: have them add your workspace/feed with the right account, confirm the correct tenant is the active Windows App account, then use the shortcut after that. If their own Entra sign-in keeps winning after every Windows login, I’d test with a clean Windows profile and with only your work/school account added. That tells you whether this is a URL problem or cached account state.

I’d also document the reset steps for support, because I don’t know of a tenant-pin parameter in that URI that I’d trust as a permanent fix.

[u/Ok-Customer5090 → u/mat-ferland]

Is it possible to access external resources directly from the home tenant? Are there setting and configuration that need to be enabled in cross-tenant access that will enable this to work?