Configuring an Entra-ID-Only Control Account

An Entra-ID-Only account does not use AD on the Workspot desktops; they are joined directly to an Entra ID domain. The choice between Entra-ID-Only and AD is made early in a new Workspot deployment. Contact Workspot if you aren’t sure which option to use.

Prerequisites

Before configuring an Entra ID-only Control Account, ensure the following requirements are met:

1. Feature Enablement

• This is a selective feature. Contact Workspot Support to enable Entra ID-only authentication for your tenant.

• Existing Entra ID-only deployments can be migrated to the newer BPRT (Bulk Primary Refresh Token) authentication method using this procedure.

2. Required Administrative Access

• Access to a Microsoft Entra Administrator account with permissions to manage your Entra ID tenant.

• Access to the Azure subscription associated with the tenant.

• Permissions to create or modify Azure Key Vault resources and role assignments.

3. New Workspot Control Account

• A new Workspot Control account is required for initial configuration.

• Existing deployments are supported only when performing a migration to the BPRT-based authentication method.

4. Azure Key Vault Permission Model

Important: Before storing the BPRT token in an Azure Key Vault, Workspot recommends using Azure Role-Based Access Control (RBAC) as the Key Vault permission model.

If you are using an existing Key Vault, verify that RBAC is enabled before proceeding:

1. Navigate to Access Configuration in the Azure Key Vault.

2. Select Azure role-based access control (RBAC) as the Permission Model.

3. Click Save to apply the changes.

4. Assign the Key Vault Secrets User role to the Workspot Enterprise Application (Service Principal)

After RBAC is enabled, ensure the Workspot Enterprise Application is granted appropriate access (for example, Key Vault Secrets User) to read the BPRT secret.

5. BPRT Token Requirements

• Windows Configuration Designer (WCD) or an approved alternative method is required to generate the Bulk Primary Refresh Token (BPRT).

• The BPRT token expiration date must be documented and monitored because the token expires silently if not renewed.

• The BPRT token will be stored as a secret in Azure Key Vault and referenced by Workspot Control.

Configuration in WCD (Windows Configuration Designer)

This step creates the BPRT (Bulk Primary Refresh Token) that is central to domain-joining Workspot desktops to the Entra ID domain.

1. Download Microsoft’s Windows Configuration Designer application from the Microsoft Store.

2. Use WCD to generate a package file, as described in Microsoft’s Bulk Enrollment for Windows Devices.

3. We will use the BRPT from this package. Points to keep in mind:

   • You must note down the expiration date of the BRPT token, which will expire silently unless you configure this date in Control.

   • The BRPT token can be found in Customizations.xml under the generated package file. For example:

   • C:\Users\{username}\Documents\Windows Imaging and Configuration Designer (WICD)\{packagename}

   • WCD also reports this path at the bottom of the screen below.

   • The BRPT token within the .xml file is between <BRPT> and </BRPT> delimiters:

Configuration in Azure

Create a Key Vault

1. Sign into the Azure Portal for the account associated with your Entra ID domain.

2. Create a Key Vault (“Home > Key vaults > Create a key vault”).

   1. Set the “Key vault name” to something that indicates what it’s for. The example uses “BPRTToken.”

   2. Fill in the remaining fields with the usual values for your Entra ID deployment.

3. On the Networking tab, set up the access for the key vault. This is usually configured for public access, as shown below. (Configuring a firewall to restrict access to Workspot Control’s static IP addresses is feasible but beyond the scope of this article):

4. In the Key Vault, create a Secret with:

   • Name: “WORKSPOT-BPRT-TOKEN”

   • Secret Value: The BPRT token value from the .xml file above.

   • Expiration date: This can be no more than six months in the future.

   • Enabled: Yes.

5. Set the access control method. Azure recommends Role-Based Access Control  (RBAC), but the earlier Access Policy method is also supported.

   1. (Recommended Role-Based Access Control Method). Go to "Access Control (IAM)" for the Key Vault and assign the "Key Vault Secrets User" role to the Workspot Enterprise Application (Service Principal).

2. (Legacy Access Policy Method) Go to “Access Configuration” and select “Vault access policy” and click “Apply.” Then create a Key Vault Access Policy that assigns “Get” permissions for both “Key Permissions” and “Secret Permissions.”

6. Find the URL of the token in the Azure Portal. We will copy the URL into Control in the next step.

Configuration in Control

1. After a new Control Account is created and verified, the user can sign in with the initial user account created during the setup.

2.  You will see a choice between “Active Directory” and “Entra ID.”

3. Select “Entra ID” and Click “Continue.”

   

4. Go to “Setup > Configuration > Authentication and Registration” if you aren’t taken there automatically.

5. Paste the URI of WORKSPOT-BPRT-TOKEN (from the previous step) into “Location of the Key Vault with BPRT token.”

6. Click the “Check URI and Save” button. You should see a green “Verified” banner.

7. (Do NOT check “Use Default System Browser” unless asked to by Workspot.)

8. Fill in the rest of the page as described in Control Setup: Configuration Page.

9. At the bottom of the page, click “Save.”

Configuring Desktop Pools and User Sign-in Methods

Entra ID-only authentication provides sign-in options not otherwise available, including RDS AAD authentication security and Windows Hello for Business. See RDS AAD Authentication to configure pools and individual user access to use these.

Converting Access Policy Method to RBAC

Customers who initially used the Access Policy method for their Key Vault can switch to the newer RBAC method as follows:

1. An Azure, go to "Access Control (IAM)" for the Key Vault.

2. Click on "Add Role Assignment".

3. Select the role "Key Vault Secrets User" and click on Next.

4. Click on "Select Members".

5. Select "Workspot" app as the Service Principal.

6. Complete the role assignment setup.

Notes

Check that the Service Principal has the necessary permissions to perform the required Key Vault operations after RBAC is enabled.

Once the setup is complete in Azure, click on the “Check URI and Save” button in Control under “Setup > Authentication” and Registration Section. If the check is successful, the setup is complete. If it fails, please verify the configuration in Azure.

Troubleshooting

Provisioning Failures (BPRT Exhaustion)

Microsoft Entra ID has a subscription-wide limit of 250 or 500 Bulk Primary Resource Tokens. Each pool and template enabling Entra ID sign-in consumes a BRPT token.

These tokens are not relinquished when pools or templates are deleted. The number of available BPRT tokens gradually becomes exhausted.

Symptoms

Once the last token is consumed:

• New desktops and templates fail to join the Entra ID domain (provisioning failures).

• Control Administrators cannot create new pools.

Existing desktops are not affected.

Workaround

Azure neither cleans up unused BPRT tokens nor exposes a way of doing so in its API. Once the limit is reached, the BPRTs must be manually deleted through the Azure portal:

1. In the Azure portal, identify BPRT tokens that are not associated with a current pool or template.

2. Delete these tokens.

3. Verify that you can now provision desktops or pools that were failing before.

“Zombie” (Stale) Desktops

Desktops can only be deregistered from Entra ID when they are running. Actions that delete desktops when they aren’t in a running state result in stale desktop entries in Entra ID. These are invisible to the Control UI but These are still visible in the Entra ID portal and the Control API, however.

These can be detected and deleted through the Control API’s (GET staleDevices) and (POST staleDevices) commands.