Passwordless Azure Virtual Desktop: Token-Based SSO with Entra ID and Okta Upstream

Back in early 2024 I wrote about getting Device Trust working on our Azure Virtual Desktop estate . The gist of that post: because no user is assigned to a pooled VDI host, you can&rsquo;t deploy a user-scoped certificate, and non-admin users can&rsquo;t read the device-scoped private key, so Okta FastPass quietly breaks. We solved it by hand-editing private-key ACLs with a PowerShell script. It…