I have an AVD Host Pool set up and working in AAD-only mode with internal AAD tenant users, but even after granting an external user the Virtual Machine User Login role and assigning an Application group to the external user in the Host Pool, neither the AVD Desktop RDP client nor the web client are displaying the assigned application group's remote app in the external user's feed (or even an entry for the application group).
For reference, Per-user access pricing was turned on for the subscription when AVD was set up. (This clarification was added subsequent to posting of Answer #1 below).
Has anyone managed to get AzureAD external accounts working in the validation environment for AAD-only AVD host pools?
It's always possible external accounts just aren't working yet, but since the per-user access promotion for external users went into effect on July 14, I suspect they're supposed to be. Hopefully someone else has had better luck and would be willing to share tips that might help me and others.
Thanks in advance!
Additional Details:
In the web RD client, when I open developer tools and check network traffic, I see the following error:
authRedirectFailure: ServerError: invalid_client: AADSTS650052: The app needs access to a service ('https://mrs-Prod.ame.gbl/mrs-RDInfra-prod') that your organization 'mysubdomain.onmicrosoft.com' has not subscribed to or enabled. Contact your IT Admin to review the configuration of your service subscriptions.
In the error above, mysubdomain.microsoft.com is the domain name for the AAD tenant that is working fine with internal accounts (these authenticating from both the web client and desktop client). I've tried authenticating external users with both the primary domain and the secondary domain and encounter the same error.
[UPDATE]: Answer #2, below addresses the specific problem I encountered- specifically that I was attempting to use AAD guest accounts in an attempt to distinguish "internal" and "external" users for Per user access licensing, and that simply isn't how Per user access licensing works, technically, for AVD.
