You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/virtual-desktop/configure-single-sign-on.md
+22-92Lines changed: 22 additions & 92 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -43,7 +43,7 @@ If you prefer to show the remote lock screen instead of disconnecting the sessio
43
43
44
44
# [Intune](#tab/intune)
45
45
46
-
To configure the clipboard using Intune, follow these steps. This process creates an Intune [settings catalog](/mem/intune/configuration/settings-catalog) policy.
46
+
To configure the session lock experience using Intune, follow these steps. This process creates an Intune [settings catalog](/mem/intune/configuration/settings-catalog) policy.
47
47
48
48
1. Sign in to the [Microsoft Intune admin center](https://intune.microsoft.com/).
49
49
@@ -64,134 +64,64 @@ To configure the clipboard using Intune, follow these steps. This process create
64
64
65
65
1. In **Configuration settings**, select **Add settings**. Then:
66
66
67
-
1. In the settings picker, expand **Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection**.
67
+
1. In the settings picker, expand **Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security**.
68
68
69
-
1. Select the following settings and make sure you select the settings with the correct scope. The `(User)` settings apply to the user scope. The other settings apply to the device scope. To determine which scope is correct for your scenario, go to [Settings catalog - Device scope vs. user scope settings](/mem/intune/configuration/settings-catalog#device-scope-vs-user-scope-settings):
70
-
71
-
- Restrict clipboard transfer from server to client
72
-
- Restrict clipboard transfer from client to server
73
-
74
-
**OR**
75
-
76
-
- Restrict clipboard transfer from server to client (User)
77
-
- Restrict clipboard transfer from client to server (User)
69
+
1. Select the **Disconnect remote session on lock for Microsoft identity platform authentication** setting.
78
70
79
71
1. Close the settings picker.
80
72
81
-
1. Configure the settings:
82
-
83
-
-**Restrict clipboard transfer from server to client**: Select **Enabled**.
84
-
-**Restrict clipboard transfer from server to client**: Select the type of clipboard data you want to prevent or allow. Your options:
85
-
86
-
- Disable clipboard transfers from server to client
87
-
- Allow plain text
88
-
- Allow plain text and images
89
-
- Allow plain text, images, and Rich Text Format
90
-
- Allow plain text, images, Rich Text Format, and HTML
91
-
92
-
-**Restrict clipboard transfer from client to server**: Select **Enabled**.
93
-
-**Restrict clipboard transfer from client to server**: Select the type of clipboard data you want to prevent or allow. Your options:
94
-
95
-
- Disable clipboard transfers from server to client
96
-
- Allow plain text
97
-
- Allow plain text and images
98
-
- Allow plain text, images, and Rich Text Format
99
-
- Allow plain text, images, Rich Text Format, and HTML
73
+
1. Configure the setting to "Disabled" to show the remote lock screen when the session locks.
100
74
101
75
1. Select **Next**.
102
76
103
-
1.At the **Scope tags** tab (optional), you can skip this step. For more information about scope tags in Intune, see [Use RBAC roles and scope tags for distributed IT](/mem/intune/fundamentals/scope-tags).
77
+
1.(Optional) Add the **Scope tags**. For more information about scope tags in Intune, see [Use RBAC roles and scope tags for distributed IT](/mem/intune/fundamentals/scope-tags).
104
78
105
-
Select **Next**.
79
+
1. Select **Next**.
106
80
107
-
1. For the **Assignments** tab, select the users, devices, or groups to receive the profile, then select **Next**. For more information on assigning profiles, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign).
81
+
1. For the **Assignments** tab, select the devices, or groups to receive the profile, then select **Next**. For more information on assigning profiles, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign).
108
82
109
83
1. On the **Review + create** tab, review the configuration information, then select **Create**.
110
84
111
-
1. Once the policy configuration is created, resync your session hosts and reboot them for the settings to take effect.
112
-
113
-
1. Connect to a remote session with a supported client and test the clipboard settings you configured are working by trying to copy and paste content.
85
+
1. Once the policy configuration is created, the setting will take effect after the session hosts sync with Intune and users initiate a new session.
114
86
115
87
# [Group Policy](#tab/group-policy)
116
88
117
-
To configure the clipboard using Group Policy, follow these steps.
118
-
119
-
> [!IMPORTANT]
120
-
> These policy settings appear in both **Computer Configuration** and **User Configuration**. If both policy settings are configured, the stricter restriction is used.
89
+
To configure the session lock experience using Group Policy, follow these steps.
121
90
122
91
1. Open **Local Group Policy Editor** from the Start menu or by running `gpedit.msc`.
123
92
124
-
1. Browse to one of the following policy sections. Use the policy section in **Computer Configuration** to the session host you target, and use the policy section in **User Configuration** applies to specific users you target.
1.Open one of the following policy settings, depending on whether you want to configure the clipboard from session host (server) to client, or client to session host:
97
+
1.Select the **Disconnect remote session on lock for Microsoft identity platform authentication** policy.
130
98
131
-
- To configure the clipboard from **session host to client**, open the policy setting **Restrict clipboard transfer from server to client**, then select **Enabled**. Choose from the following options:
132
-
-**Disable clipboard transfers from server to client**.
133
-
-**Allow plain text.**
134
-
-**Allow plain text and images.**
135
-
-**Allow plain text, images, and Rich Text Format.**
136
-
-**Allow plain text, images, Rich Text Format, and HTML.**
137
-
138
-
- To configure the clipboard from **client to session host**, open the policy setting **Restrict clipboard transfer from client to server**, then select **Enabled** . Choose from the following options:
139
-
-**Disable clipboard transfers from client to server**.
140
-
-**Allow plain text.**
141
-
-**Allow plain text and images.**
142
-
-**Allow plain text, images, and Rich Text Format.**
143
-
-**Allow plain text, images, Rich Text Format, and HTML.**
99
+
1. Set the policy to "Disabled" to show the remote lock screen when the session locks.
144
100
145
101
1. Select **OK** to save your changes.
146
102
147
-
1. Once you configured settings, restart your session hosts for the settings to take effect.
148
-
149
-
1. Connect to a remote session with a supported client and test the clipboard settings you configured are working by trying to copy and paste content.
103
+
1. Once the policy is configured, it will take effect after the user initiate a new session.
150
104
151
105
> [!TIP]
152
106
> During the preview, you can also configure Group Policy centrally in an Active Directory domain by copying the `terminalserver.admx` and `terminalserver.adml` administrative template files from a session host to the [Group Policy Central Store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) in a test environment.
153
107
154
108
# [Registry](#tab/registry)
155
109
156
-
To configure the clipboard using the registry on a session host, follow these steps.
110
+
To configure the session lock experience using the registry on a session host, follow these steps.
157
111
158
112
1. Open **Registry Editor** from the Start menu or by running `regedit.exe`.
159
113
160
-
1. Set one of the following registry keys and its value, depending on whether you want to configure the clipboard from session host to client, or client to session host.
114
+
1. Set the following registry key and its value.
161
115
162
-
- To configure the clipboard from **session host to client**, set one of the following registry keys and its value. Using the value for the machine applies to all users, and using the value for the user applies to the current user only.
-**Value data**: Enter a value from the following table:
169
120
170
121
| Value Data | Description |
171
122
|--|--|
172
-
|`0`| Disable clipboard transfers from session host to client. |
173
-
|`1`| Allow plain text. |
174
-
|`2`| Allow plain text and images. |
175
-
|`3`| Allow plain text, images, and Rich Text Format. |
176
-
|`4`| Allow plain text, images, Rich Text Format, and HTML. |
177
-
178
-
- To configure the clipboard from **client to session host**, set one of the following registry keys and its value. Using the value for the machine applies to all users, and using the value for the user applies to the current user only.
0 commit comments