You can use Azure AD for SSO login into the product, but currently the host logins don't work when windows would need to authenticate against an azure domain. The login page would redirect to the federated authentication page, so it recognizes the domain and forwards the user there.
Ash, I wouldn't actually mind the redirect on the remote connection side. It would be worth it to be able to completely disable the built in Administrator account on those machines. I wouldn't even mind if you didn't get the credential passthrough as long as my AAD account can get access to the machines.
