> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/server/knowledge-base/how-to-articles/configure-domain-single-sign-on-sso.md). # Configure domain single sign-on (SSO) Enable domain single sign-on (SSO) in Devolutions Server with IIS Windows Authentication, then turn it on in Remote Desktop Manager workspaces. {% hint style="info" %} The machine hosting Devolutions Server must be joined to the [configured domain](/server/web-interface/administration/configuration/server-settings/general/authentication/domain.md) for domain single sign-on (SSO) to work. {% endhint %} Domain single sign-on (SSO) signs users in to Devolutions Server with their Windows domain account. It requires the IIS Windows Authentication feature on the server hosting Devolutions Server, the domain SSO setting in Devolutions Server, and the matching option in each Remote Desktop Manager workspace. ### Configure IIS The Devolutions Server web.config file already enables Windows Authentication where domain SSO needs it, on the sign-in endpoint `api/login-oauth/windows`. When it installs or upgrades an instance, the Devolutions Server Console sets the ***Authentication - Windows*** feature delegation to ***Read/Write*** for the Devolutions Server application. Configure IIS manually only when the Console reports that it was unable to configure feature delegation. 1. Open the ***Server Manager*** desktop application. 2. Go to ***Manage*** – ***Add Roles and Features***. 3. In the ***Server Roles*** section, confirm that the ***Windows Authentication*** role service is installed under ***Web Server (IIS)*** – ***Web Server*** – ***Security***. 4. Close the ***Add Roles and Features Wizard*** and ***Server Manager***. 5. Open ***IIS Manager***. 6. Select the server in the tree view. 7. Open ***Feature Delegation*** in the ***Management*** section. 8. Set the ***Authentication - Windows*** feature to ***Read/Write***. 9. Close ***IIS Manager***. ### Enable domain SSO in Devolutions Server 1. In the Devolutions Server web interface, go to ***Administration*** – ***Server settings*** – ***Authentication***. 2. In ***Authentication modes***, check ***Authenticate with domain user***. 3. In ***Domain single sign-on (SSO)***, check ***Enable domain single sign-on (SSO)***. 4. Optionally, check ***Hide domain login*** to hide the domain username and password sign-in on the sign-in page when the domain SSO option is displayed. 5. Click ***Save***. 6. In ***Configuration***, click ***Domains***. 7. Set the ***Administration credentials*** of the domain. ### Enable domain SSO in Remote Desktop Manager 1. In Remote Desktop Manager, go to ***File*** – ***Workspaces***. 2. Select the Devolutions Server workspace. 3. Click ***Edit workspace***. 4. In the ***General*** tab, check ***Use domain single sign-on (SSO)***. 5. Click ***Save***. 6. Repeat on each client computer, or deploy the workspace with an [exported workspace file](https://docs.devolutions.net/rdm/getting-started/workspaces/import-and-export-a-workspace). When connecting, Remote Desktop Manager opens the Devolutions Server sign-in page, in its embedded login window or in the default browser depending on the ***Authentication browser mode*** setting of the workspace (***Advanced*** tab). The sign-in page then signs the user in with the Windows account. When multifactor authentication is enabled, it is still required after the Windows sign-in. Without multifactor authentication, Devolutions Server can display a [device sign-in confirmation](/server/knowledge-base/troubleshooting-articles/device-sign-in-confirmation-when-signing-in-to-devolutions-server.md) page. {% hint style="warning" %} On Windows, the sign-in is silent only when the Devolutions Server URL is in the ***Local intranet*** zone of the client computers. Otherwise, the browser asks for credentials. Consult [Credentials prompt instead of domain single sign-on](/server/knowledge-base/troubleshooting-articles/credentials-prompt-instead-of-domain-single-sign-on.md). {% endhint %} The ***Use domain single sign-on (SSO)*** option is not available in Remote Desktop Manager on macOS. On Linux, Windows zones do not exist: the sign-in depends on the Kerberos configuration of the computer, and the ***Local intranet*** zone setting does not apply. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.devolutions.net/server/knowledge-base/how-to-articles/configure-domain-single-sign-on-sso.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.