Azure Virtual Desktop puts corporate desktops and apps a sign-in away from any device, so the security of an AVD deployment rests on the identity, network and session host settings that the customer controls. Microsoft's shared responsibility model for AVD keeps the virtualisation control plane, physical hosts, network and datacentres on Microsoft's side, and places identity, user devices, application security, the session host operating system, deployment configuration and network controls with the customer. This guide is for Azure, end user computing and identity teams who run or are building AVD host pools. It covers Conditional Access for the AVD apps, Azure RBAC for AVD resources, host pool and session host hardening, RDP Shortpath and Private Link choices, device redirection, screen capture protection and watermarking, and the logs to monitor.
This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.
Key takeaways
- Target both AVD apps in Conditional Access. Apply MFA and device policies to the Azure Virtual Desktop app and, when single sign-on is on, to Windows Cloud Login, and leave the Azure Resource Manager Provider app unselected as Microsoft instructs.
- Match the host pool to the trust level. Microsoft recommends multi-session pooled hosts for standard users of one organisation, personal host pools for users who need administrator rights, and a separate tenant and subscription for users from different organisations.
- Keep users out of local administrators. On pooled hosts a local administrator can cross session boundaries or shut down a shared VM; deliver software through Intune or images instead.
- Keep redirection off unless there is a need. Drive, clipboard, printer and USB redirection start disabled in Microsoft's guidance; enable each one deliberately and prefer OneDrive and Universal Print for file and print flows.
- Layer data protections. Screen capture protection, watermarking and redirection limits work together with Conditional Access and data loss prevention, and Microsoft positions screen capture protection as one layer in that set.
How identity and access work in Azure Virtual Desktop
A user connection involves several Entra ID applications and one Azure RBAC data action. The user signs in to the Windows App or web client, subscribes to a workspace feed, receives an RDP file for an application group they are assigned to, and connects through the AVD gateway to a session host using reverse connect. With single sign-on enabled, the session host sign-in uses Entra ID authentication through the Windows Cloud Login app.
Conditional Access targets
| Entra application | App ID | Microsoft's guidance |
|---|---|---|
| Azure Virtual Desktop | 9cdead84-a844-4324-93f2-b2e6bb768d07 | Target for MFA; covers feed subscription, gateway authentication and diagnostics upload |
| Windows Cloud Login | 270efc09-cd0d-444b-a71f-39af4910ec45 | Target when SSO is enabled; mirror the AVD app policy except sign-in frequency |
| Azure Virtual Desktop Azure Resource Manager Provider | 50e95039-b200-4007-bc97-8d5790743a63 | Leave unselected; used only to retrieve the user feed |
| Windows 365 | 0af06dc6-e4b5-4f28-818e-e78e62d137a5 | Leave unblocked; the Windows App authenticates to it even for AVD-only users |
- Grant controls: Microsoft's base policy targets the AVD user group, both client app types, and requires MFA. Strengthen it with an authentication strength that requires phishing-resistant methods. See the Conditional Access Guide.
- Sign-in frequency: A periodic interval (Microsoft's example is one hour) applies to both apps. "Every time" is supported on Windows Cloud Login with SSO, where users are prompted after 5 to 10 minutes since their last authentication. Keep frequency aligned across both policies.
- Before enabling SSO: Review policies that target all cloud apps, device compliance requirements and location conditions, because the IP address seen for Windows Cloud Login can differ from the client IP. Turn off legacy per-user MFA in favour of Conditional Access. See Entra Per-User MFA to Conditional Access.
- Token Protection: Microsoft recommends requiring Token Protection on the endpoint that runs the Windows App; it applies to the client device rather than the session host.
- Licensing: Conditional Access needs Entra ID P1 or P2 and is used in place of Security Defaults.
Trust boundaries
| User population | Microsoft's recommended model |
|---|---|
| Standard users in the same organisation | Windows Enterprise multi-session, pooled host pool |
| Users who need administrator rights | Personal host pool, one session host per user |
| Users from different organisations | Separate Entra tenant and Azure subscription |
Admin roles and privileged access
AVD has its own Azure built-in roles. Assign them to groups at the narrowest scope (host pool, application group or workspace) rather than at subscription level.
| Role | What it allows | Typical holder |
|---|---|---|
| Desktop Virtualization Contributor | Manage all AVD resources except user and group assignment (which also needs User Access Administrator); no access to compute | Platform team |
| Desktop Virtualization Host Pool Contributor | Manage host pools; creating VMs also needs Virtual Machine Contributor | Image and capacity team |
| Desktop Virtualization Application Group Contributor | Manage application groups except assignment | Application packaging team |
| Desktop Virtualization User Session Operator | Send messages, disconnect and log off users | Service desk |
| Desktop Virtualization Session Host Operator | View and remove session hosts, change drain mode | Operations |
| Desktop Virtualization Reader (and per-object readers) | View only | Auditors, security operations |
| Desktop Virtualization User | Use applications in an application group (data action applicationGroups/useApplications/action) | End users, via groups |
- Separate assignment from management: The Contributor roles deliberately leave user assignment to User Access Administrator. Keep that right with identity governance, not the platform team.
- Tiered admin access on hosts: Microsoft advises against granting users admin rights on virtual desktops. Administrators should sign in to session hosts with separate admin accounts, and direct RDP to hosts should be avoided or, where needed, given through just-in-time access.
- Elevate just in time: Use PIM for Azure roles with assignment rights. See the Privileged Identity Management (PIM) Guide.
Integrations, API tokens and service accounts
- Power management roles: Desktop Virtualization Power On Contributor, Power On Off Contributor and Virtual Machine Contributor let the AVD resource provider start, stop or manage VMs for autoscale and session host management. Grant them to the AVD service principal only at the scope it needs.
- Host registration: New session hosts register with a host pool registration key. Generate it with a short expiry for each build, store it in Azure Key Vault and let it lapse after use.
- Domain join credentials: Hybrid-joined hosts use a domain join account. Restrict it to joining computers to the AVD organisational unit, keep its password in Key Vault and rotate it. Entra-joined session hosts remove this account. See Entra Device Identity.
- Profile storage: FSLogix profile containers on Azure Files should use private endpoints and identity-based access, as Microsoft's recommendations describe. Exclude FSLogix virtual disk extensions from antivirus scanning, and keep BitLocker off the disk that stores FSLogix profile data, per Microsoft's guidance.
- Automation identities: Image pipelines and scaling scripts should use managed identities, not stored service principal secrets. See the Microsoft Azure Security Guide.
Network: RDP Shortpath and Private Link
AVD uses TCP reverse connect by default, so session hosts need no inbound ports. RDP Shortpath adds a UDP transport after the connection is brokered and authenticated over reverse connect; Microsoft states it uses TLS over reliable UDP with the same security as reverse connect.
| Option | Ports and path (per Microsoft Learn) | Security consideration |
|---|---|---|
| Shortpath for managed networks, listener | Inbound UDP 3390 (default) on each session host over ExpressRoute or VPN | Opens an inbound port on hosts; the STUN option on managed networks avoids it |
| Shortpath via STUN | Outbound UDP 3478 to 51.5.0.0/16 (Azure cloud); ephemeral ports, default 49152 to 65535, which can be narrowed | Requires outbound UDP from hosts; limit the client port range |
| Shortpath via TURN relay | Outbound UDP 3478 to the relay range | Fallback when direct paths fail |
| Private Link | Private endpoints for global (one per deployment, on a dedicated workspace), feed (per workspace) and connection (per host pool) | Allow the full TCP 1 to 65535 range to the connection endpoint; use the privatelink-global.wvd.microsoft.com zone for global |
- Public network access: Host pools can disable public access entirely, or enable it for end users while requiring private access for session hosts. Workspaces have a matching setting for feed download.
- UDP over Private Link: To use Shortpath with Private Link, select Allow Direct UDP network path over Private Link under Networking > Public access and turn off the STUN and TURN public network options in the RDP Shortpath tab.
- Egress filtering: Microsoft notes session hosts can reach any internet resource by default. Filter outbound traffic with Azure Firewall, a network virtual appliance or a proxy, keeping the endpoints AVD requires. Restart the RDAgentBootLoader service or the hosts after changing a host pool's private endpoint configuration.
- Global Secure Access: Microsoft recommends it for private, internet and Microsoft 365 app access from sessions. See Microsoft Entra Private Access.
Hardening baseline
Session hosts
- Trusted Launch: The Azure portal defaults to Trusted virtual machines, which provide Secure Boot, vTPM and integrity monitoring. Keep them on, and consider confidential VMs for sensitive workloads.
- Virtualisation-based security: Enable HVCI and Credential Guard, and use App Control for Business policies targeted at devices. Microsoft describes RemoteApp as an app presentation method and recommends App Control or AppLocker to decide which apps can run. See App Control for Business (WDAC) and Credential Guard and VBS.
- Endpoint protection and EDR: Run Microsoft Defender Antivirus or another product with EDR on every host; Defender for Cloud can deploy Defender for Endpoint on server operating systems.
- Patching: Patch the OS, applications and golden images; Microsoft suggests monthly image updates following vendor notifications.
- Encryption: Use managed disk encryption, with OS disk encryption bound to the vTPM where appropriate.
- Administrator protection: Microsoft advises keeping the Windows 11 Administrator protection feature off on session hosts. If a security baseline turns it on, set User Account Control: Configure type of Admin Approval Mode to Legacy Admin Approval Mode and restart.
- Sessions: Set maximum inactive and disconnection time limits suited to each workload, and lock the screen on idle with authentication to unlock.
Data protection controls
| Control | Where it is set | Notes from Microsoft Learn |
|---|---|---|
| Drive, clipboard, printer, USB redirection | Host pool RDP properties | Off in Microsoft's guidance; use clipboard transfer direction to restrict content types, OneDrive for files, Universal Print for printing |
| Screen capture protection | Intune Settings catalog: Enable screen capture protection under Remote Desktop Session Host > Azure Virtual Desktop | Options: block on client, or block on client and server; mobile and web clients also need an Intune MAM policy; Windows 10 or 11 22H2 or later; new sessions only |
| Watermarking | Intune Settings catalog: Enable watermarking (not the deprecated setting) | QR code with Connection ID or Device ID; requires AVD Insights; only watermarking-capable clients can connect |
| Conditional Access app protection | Grant Require app protection policy for mobile and browser platforms | Pairs with MAM so mobile connections are allowed only when screen capture is blocked |
Roll out in rings: a pilot host pool with a validation environment first, then broader pools. Screen capture protection and watermarking both affect which clients can connect, so test the full client estate and keep the previous policy assignment ready to restore.
Logging and detection
Microsoft recommends collecting the Azure Activity Log, Entra sign-in and audit logs, session host logs and Key Vault logs, and enabling AVD diagnostic settings on each host pool, application group and workspace, sent to a Log Analytics workspace.
| Source | What to watch |
|---|---|
WVDConnections | Connection states by UserName, client IP and CorrelationId; trace a watermark QR code to a session through CorrelationId |
WVDErrors | Repeated failures for one user, host registration errors |
WVDCheckpoints | Published app usage over a session |
| Management Activities diagnostic category | Changes to AVD objects through APIs or PowerShell |
| Entra sign-in logs (both AVD apps) | Conditional Access results, unexpected locations, legacy per-user MFA errors |
| Azure Activity Log | Role assignments, registration key generation, public network access changes |
See the Microsoft Defender for Cloud Guide for Secure Score recommendations that cover AVD session hosts.
Metrics
- Sign-ins to AVD apps satisfied by phishing-resistant methods: target 100% of interactive sign-ins.
- Users with local administrator rights on pooled hosts: zero.
- Host pools with any redirection enabled, each with a documented business reason.
- Session hosts running the current monthly image: above 95%.
- Host pools with diagnostic settings sending all categories to Log Analytics: 100%.
Common misconfigurations
- Only the AVD app in Conditional Access: With SSO enabled, the session host sign-in goes through Windows Cloud Login. Target both apps with matching policies.
- Selecting the Resource Manager Provider app: Microsoft instructs leaving it out; requiring MFA there interferes with feed retrieval.
- Local admin on pooled hosts: Move users who need admin rights to personal host pools.
- Redirection enabled at creation and never reviewed: Audit RDP properties per host pool and turn off what is not needed.
- Long-lived registration keys: Set short expiry and keep keys in Key Vault.
- Unrestricted egress from session hosts: Add outbound filtering while keeping AVD's required endpoints.
Framework mapping
| Framework | Reference | AVD control |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-17 Remote Access; IA-2 Identification and Authentication (Organizational Users) | Conditional Access with phishing-resistant MFA on AVD apps |
| NIST SP 800-53 Rev 5 | AC-6 Least Privilege; AC-12 Session Termination; AC-11 Device Lock | AVD RBAC, no local admin, idle limits and screen lock |
| NIST SP 800-53 Rev 5 | CM-7 Least Functionality; SC-7 Boundary Protection | Redirection off, App Control, egress filtering, Private Link |
| NIST SP 800-53 Rev 5 | AU-2 Event Logging; SI-4 System Monitoring | Diagnostic settings, Entra and Activity logs, EDR |
| NIST CSF 2.0 | PR.AA-05; PR.PS-01; DE.CM-01 | Least privilege, configuration baselines, network monitoring |
Practitioner checklist
- Create Conditional Access policies for the Azure Virtual Desktop and Windows Cloud Login apps with phishing-resistant authentication and aligned sign-in frequency.
- Leave the AVD Azure Resource Manager Provider app unselected and the Windows 365 app unblocked.
- Map each user population to the right host pool model and remove local admin from pooled hosts.
- Assign AVD built-in roles to groups at host pool, application group or workspace scope, with assignment rights held separately.
- Store registration keys and domain join credentials in Key Vault with short expiry and rotation, or move to Entra-joined hosts.
- Decide on RDP Shortpath and Private Link per host pool, and filter session host egress.
- Deploy Trusted Launch hosts with HVCI, Credential Guard, App Control and EDR, patched from a monthly image.
- Keep redirection off by default and enable each type only with a recorded reason.
- Pilot screen capture protection and watermarking with the full client estate before broad rollout.
- Send all AVD diagnostic categories, Entra logs and Activity Logs to Log Analytics and alert on role and network access changes.
Standards and references
- Microsoft Learn: Security recommendations for Azure Virtual Desktop
- Microsoft Learn: Enforce Microsoft Entra multifactor authentication for Azure Virtual Desktop using Conditional Access
- Microsoft Learn: Built-in Azure RBAC roles for Azure Virtual Desktop
- Microsoft Learn: RDP Shortpath for Azure Virtual Desktop
- Microsoft Learn: Azure Private Link with Azure Virtual Desktop
- Microsoft Learn: Screen capture protection in Azure Virtual Desktop
- Microsoft Learn: Watermarking in Azure Virtual Desktop
- Microsoft Learn: Send diagnostic data to Log Analytics for Azure Virtual Desktop
Related NHI Mgmt Group resources: Remote Desktop (RDP) Security Guide · Conditional Access Guide · Microsoft Intune Guide