A computer system comprising the following: one or more processors; system memory; one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by the one or more processors, causes the computer system to perform a method for authenticating a user to a remote application provisioning service, the method comprising the following: an act of receiving one or more authentication credentials from a user at a client computer system to authenticate the user to a remote application provisioning service that provides virtual machine-hosted remote applications; an act of sending, by the client computer system, the received authentication credentials to an authentication service, the authentication service being configured to generate an encrypted token based on the received authentication credentials; an act of receiving, by the client computer system, the generated encrypted token from the authentication service; an act of storing, by the client computer system, the received encrypted token and the received authentication credentials in a data store; an act of sending, by the client computer system, the encrypted token to the remote application provisioning service, the encrypted token indicating to the remote application provisioning service that the user is a valid user; an act of the remote application provisioning service decrypting the received encrypted token; an act of determining, by the remote application provisioning service, the user's identity from the decrypted token; an act of determining, at the remote application provisioning service, based on the user's identity, which remote applications the user is authorized to access; and an act of receiving, by the client computer system, from the remote application provisioning service an indication of one or more remote applications the user is allowed to access; an act of receiving, by the client computer system, from the user an indication indicating that at least one of the remote applications is to be instantiated; an act of sending, by the client computer system, the user's stored authentication credentials and the stored encrypted token to the virtual machine that is hosting the indicated remote application; and upon being authenticated to the virtual machine that is hosting the indicated remote application, an act of accessing, by the user, the indicated instantiated remote application. an act of receiving one or more authentication credentials from a user at a client computer system to authenticate the user to a remote application provisioning service that provides virtual machine-hosted remote applications; an act of sending, by the client computer system, the received authentication credentials to an authentication service, the authentication service being configured to generate an encrypted token based on the received authentication credentials; an act of receiving, by the client computer system, the generated encrypted token from the authentication service; an act of storing, by the client computer system, the received encrypted token and the received authentication credentials in a data store; an act of sending, by the client computer system, the encrypted token to the remote application provisioning service, the encrypted token indicating to the remote application provisioning service that the user is a valid user; an act of the remote application provisioning service decrypting the received encrypted token; an act of determining, by the remote application provisioning service, the user's identity from the decrypted token; an act of determining, at the remote application provisioning service, based on the user's identity, which remote applications the user is authorized to access; and an act of receiving, by the client computer system, from the remote application provisioning service an indication of one or more remote applications the user is allowed to access; an act of receiving, by the client computer system, from the user an indication indicating that at least one of the remote applications is to be instantiated; an act of sending, by the client computer system, the user's stored authentication credentials and the stored encrypted token to the virtual machine that is hosting the indicated remote application; and upon being authenticated to the virtual machine that is hosting the indicated remote application, an act of accessing, by the user, the indicated instantiated remote application.