When single sign-on technology is a good fit for VDI

Control access outside of Active Directory

About four years ago, users primarily accessed resources linked to the organization's Active Directory. SSO is unnecessary in that case, because Windows handles access control. IT can set access control lists in AD and attach specific users with read or write privileges.

Today, users access Active Directory resources, cloud resources and even resources within an Active Directory forest. An AD forest includes groups of users, machines and endpoints -- known as Active directory domains -- and groups of domains, referred to as an AD tree. For access beyond the local Active Directory environment, users are typically required to supply a set of credentials for each external resource that they access. SSO allows users to access both local and external resources with one login.

VDI single sign-on boosts security, user experience

It's increasingly common for apps to reside outside of virtual desktops.

Providing users with access to external resources without using SSO can sometimes weaken an organization's security. Let's be realistic: There is a limit to the number of passwords a user can remember. Users' ability to memorize passwords decreases when a company requires that they include complexities such as numbers and capital letters, or if they have to frequently change passwords.

It's now commonplace for users to write down their passwords or use the same password for each resource they access. In an effort to increase security, IT inevitably pushes workers into using techniques that can nullify an organization's protective measures.

Single sign-on technology can reduce the burden on employees by allowing them to remember just one password. In that case, the organization can realistically require users to use much stronger password combinations or even two-factor authentication. Additionally, each protected resource continues to maintain its own authentication credentials, which is different than using the same password for every resource.

SSO is especially beneficial in updated VDI implementations, because it's increasingly common for apps to reside outside of virtual desktops. For example, some applications may live in a software as a service cloud, or Windows apps may exist as Microsoft Azure remote apps. For the latter, admins can extend Active Directory to the cloud with Azure AD. Even if security isn't a major issue, users probably don't want to enter a password every time they launch an application.

Smart cards and biometric single sign-on

Some organizations have found that SSO works best when it is tied to biometric or smart card authentication. Those two methods allow users to log in without passwords, simultaneously improving security and making the authentication process more seamless for the user.

Using biometric single sign-on or smart card authentication allows users in certain work environments to be more productive. Unlike PCs, virtual desktops are not limited to specific network endpoints. Users might access the same virtual desktop from multiple physical devices as a part of their regular workflow. For example, a clinician might move between an office and exam or lab rooms throughout the day. SSO using biometric or smart card authentication would allow such a person to effortlessly move from one physical device to another.

Although this type of security works well for some organizations, it is sometimes better for an organization to continue to use passwords with SSO. The reason for this is simple: Not every device that supports VDI has the hardware to also support smart card authentication or biometric single sign-on.

SSO is useful for organizations with a layer of separation between virtual desktops and applications, but shops whose users access resources solely from within AD probably won't benefit significantly from SSO.