You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/virtual-desktop/authentication.md
+57-25Lines changed: 57 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ services: virtual-desktop
5
5
author: Heidilohr
6
6
ms.service: virtual-desktop
7
7
ms.topic: conceptual
8
-
ms.date: 12/07/2021
8
+
ms.date: 08/24/2022
9
9
ms.author: helohr
10
10
manager: femila
11
11
---
@@ -15,11 +15,11 @@ In this article, we'll give you a brief overview of what kinds of identities and
15
15
16
16
## Identities
17
17
18
-
Azure Virtual desktop supports different types of identities depending on which configuration you choose. This section explains which identities you can use for each configuration.
18
+
Azure Virtual Desktop supports different types of identities depending on which configuration you choose. This section explains which identities you can use for each configuration.
19
19
20
20
### On-premises identity
21
21
22
-
Since users must be discoverable through Azure Active Directory (Azure AD) to access the Azure Virtual Desktop, user identities that exist only in Active Directory Domain Services (AD DS) are not supported. This includes standalone Active Directory deployments with Active Directory Federation Services (AD FS).
22
+
Since users must be discoverable through Azure Active Directory (Azure AD) to access the Azure Virtual Desktop, user identities that exist only in Active Directory Domain Services (AD DS) aren't supported. This includes standalone Active Directory deployments with Active Directory Federation Services (AD FS).
23
23
24
24
### Hybrid identity
25
25
@@ -29,69 +29,101 @@ When accessing Azure Virtual Desktop using hybrid identities, sometimes the User
29
29
30
30
### Cloud-only identity
31
31
32
-
Azure Virtual Desktop supports cloud-only identities when using [Azure AD-joined VMs](deploy-azure-ad-joined-vm.md).
32
+
Azure Virtual Desktop supports cloud-only identities when using [Azure AD-joined VMs](deploy-azure-ad-joined-vm.md). These users are created and managed directly in Azure AD.
33
+
34
+
### Third-party identity providers
35
+
36
+
If you're using an Identity Provider (IdP) other than Azure AD to manage your user accounts, you must ensure that:
37
+
38
+
- Your IdP is [federated with Azure AD](../active-directory/devices/azureadjoin-plan.md#federated-environment).
39
+
- Your session hosts are Azure AD-joined or [Hybrid Azure AD-joined](../active-directory/devices/hybrid-azuread-join-plan.md).
40
+
- You enable [Azure AD authentication](configure-single-sign-on.md) to the session host.
33
41
34
42
### External identity
35
43
36
44
Azure Virtual Desktop currently doesn't support [external identities](../active-directory/external-identities/index.yml).
37
45
38
46
## Service authentication
39
47
40
-
To access Azure Virtual Desktop resources, you must first authenticate to the service by signing in to an Azure AD account. Authentication happens when subscribing to a workspace to retrieve your resources or every time you connect to apps or desktops. You can use [third-party identity providers](../active-directory/devices/azureadjoin-plan.md#federated-environment) as long as they federate with Azure AD.
48
+
To access Azure Virtual Desktop resources, you must first authenticate to the service by signing in with an Azure AD account. Authentication happens whenever you subscribe to a workspace to retrieve your resources and connect to apps or desktops. You can use [third-party identity providers](../active-directory/devices/azureadjoin-plan.md#federated-environment) as long as they federate with Azure AD.
41
49
42
50
### Multi-factor authentication
43
51
44
52
Follow the instructions in [Enforce Azure Active Directory Multi-Factor Authentication for Azure Virtual Desktop using Conditional Access](set-up-mfa.md) to learn how to enforce Azure AD Multi-Factor Authentication for your deployment. That article will also tell you how to configure how often your users are prompted to enter their credentials. When deploying Azure AD-joined VMs, note the extra steps for [Azure AD-joined session host VMs](set-up-mfa.md#azure-ad-joined-session-host-vms).
45
53
54
+
### Passwordless authentication
55
+
56
+
You can use any authentication type supported by Azure AD, such as [Windows Hello for Business](/security/identity-protection/hello-for-business/hello-overview) and other [passwordless authentication options](../active-directory/authentication/concept-authentication-passwordless.md) (for example, FIDO keys), to authenticate to the service.
57
+
46
58
### Smart card authentication
47
59
48
-
To use a smart card to authenticate to Azure AD, you must first [configure AD FS for user certificate authentication](/windows-server/identity/ad-fs/operations/configure-user-certificate-authentication).
60
+
To use a smart card to authenticate to Azure AD, you must first [configure AD FS for user certificate authentication](/windows-server/identity/ad-fs/operations/configure-user-certificate-authentication) or [configure Azure AD certificate-based authentication](../active-directory/authentication/concept-certificate-based-authentication.md).
49
61
50
62
## Session host authentication
51
63
52
-
If you haven't already enabled [single sign-on](#single-sign-on-sso) or saved your credentials locally, you'll also need to authenticate to the session host. These are the sign-in methods for the session host that the Azure Virtual Desktop clients currently support:
64
+
If you haven't already enabled [single sign-on](#single-sign-on-sso) or saved your credentials locally, you'll also need to authenticate to the session host when launching a connection. The following list describes which types of authentication each Azure Virtual Desktop client currently supports.
53
65
54
-
- Windows Desktop client
66
+
-The Windows Desktop client supports the following authentication methods:
55
67
- Username and password
56
-
-Smartcard
68
+
-Smart card
57
69
-[Windows Hello for Business certificate trust](/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust)
58
70
-[Windows Hello for Business key trust with certificates](/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs)
59
-
- Windows Store client
71
+
-[Azure AD authentication](configure-single-sign-on.md)
72
+
- The Windows Store client supports the following authentication method:
60
73
- Username and password
61
-
-Web client
74
+
-The web client supports the following authentication method:
62
75
- Username and password
63
-
- Android
76
+
-The Android client supports the following authentication method:
64
77
- Username and password
65
-
- iOS
78
+
-The iOS client supports the following authentication method:
66
79
- Username and password
67
-
- macOS
80
+
-The macOS client supports the following authentication method:
68
81
- Username and password
69
82
70
83
>[!IMPORTANT]
71
-
>In order for authentication to work properly, your local machine must also be able to access the URLs in the [Remote Desktop clients](safe-url-list.md#remote-desktop-clients) section of our [required URL list](safe-url-list.md).
72
-
73
-
Azure Virtual Desktop supports both NT LAN Manager (NTLM) and Kerberos for session host authentication. Smart card and Windows Hello for Business can only use Kerberos to sign in. To use Kerberos, the client needs to get Kerberos security tickets from a Key Distribution Center (KDC) service running on a domain controller. To get tickets, the client needs a direct networking line-of-sight to the domain controller. You can get a line-of-sight by connecting directly within your corporate network, using a VPN connection or setting up a [KDC Proxy server](key-distribution-center-proxy.md).
84
+
>In order for authentication to work properly, your local machine must also be able to access the [required URLs for Remote Desktop clients](safe-url-list.md#remote-desktop-clients).
74
85
75
86
### Single sign-on (SSO)
76
87
77
-
Azure Virtual Desktop supports [SSO using Active Directory Federation Services (ADFS)](configure-adfs-sso.md) for the Windows and web clients. SSO allows you to skip the session host authentication.
88
+
SSO allows the connection to skip the session host credential prompt and automatically sign the user in to Windows. For session hosts that are Azure AD-joined or Hybrid Azure AD-joined, it's recommended to enable [SSO using Azure AD authentication](configure-single-sign-on.md). Azure AD authentication provides other benefits including passwordless authentication and support for third-party identity providers.
89
+
90
+
Azure Virtual Desktop also supports [SSO using Active Directory Federation Services (AD FS)](configure-adfs-sso.md) for the Windows Desktop and web clients.
78
91
79
-
Otherwise, the only way to avoid being prompted for your credentials for the session host is to save them in the client. We recommend you only do this with secure devices to prevent other users from accessing your resources.
92
+
Without SSO, the client will prompt users for their session host credentials for every connection. The only way to avoid being prompted is to save the credentials in the client. We recommend you only save credentials on secure devices to prevent other users from accessing your resources.
93
+
94
+
### Smart card and Windows Hello for Business
95
+
96
+
Azure Virtual Desktop supports both NT LAN Manager (NTLM) and Kerberos for session host authentication, however Smart card and Windows Hello for Business can only use Kerberos to sign in. To use Kerberos, the client needs to get Kerberos security tickets from a Key Distribution Center (KDC) service running on a domain controller. To get tickets, the client needs a direct networking line-of-sight to the domain controller. You can get a line-of-sight by connecting directly within your corporate network, using a VPN connection or setting up a [KDC Proxy server](key-distribution-center-proxy.md).
80
97
81
98
## In-session authentication
82
99
83
100
Once you're connected to your remote app or desktop, you may be prompted for authentication inside the session. This section explains how to use credentials other than username and password in this scenario.
> In-session passwordless authentication is currently in public preview.
106
+
> This preview version is provided without a service level agreement, and is not recommended for production workloads. Certain features might not be supported or might have constrained capabilities.
107
+
> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
108
+
109
+
Azure Virtual Desktop supports in-session passwordless authentication (preview) using [Windows Hello for Business](/security/identity-protection/hello-for-business/hello-overview) or security devices like FIDO keys. Passwordless authentication is currently only available for certain versions of Windows Insider. When deploying new session hosts, choose one of the following images:
110
+
111
+
- Windows 11 version 22H2 Enterprise, (Preview) - X64 Gen 2.
112
+
- Windows 11 version 22H2 Enterprise multi-session, (Preview) - X64 Gen2.
113
+
114
+
Passwordless authentication is enabled by default when the local PC and session hosts use one of the supported operating systems above. You can disable it using the [WebAuthn redirection](configure-device-redirections.md#webauthn-redirection) RDP property.
115
+
116
+
When enabled, all WebAuthn requests in the session are redirected to the local PC. You can use Windows Hello for Business or locally attached security devices to complete the authentication process.
86
117
87
-
To use a smart card in your session, make sure you've installed the smart card drivers on the session host and enabled [smart card redirection](configure-device-redirections.md#smart-card-redirection) is enabled. Review the [client comparison chart](/windows-server/remote/remote-desktop-services/clients/remote-desktop-app-compare#other-redirection-devices-etc) to make sure your client supports smart card redirection.
118
+
To access Azure AD resources with Windows Hello for Business or security devices, you must enable the FIDO2 Security Key as an authentication method for your users. To enable this method, follow the steps in [Enable FIDO2 security key method](../active-directory/authentication/howto-authentication-passwordless-security-key.md#enable-fido2-security-key-method).
88
119
89
-
### FIDO2 and Windows Hello for Business
120
+
### In-session smart card authentication
90
121
91
-
Azure Virtual Desktop doesn't currently support in-session authentication with FIDO2 or Windows Hello for Business.
122
+
To use a smart card in your session, make sure you've installed the smart card drivers on the session host and enabled [smart card redirection](configure-device-redirections.md#smart-card-redirection). Review the [client comparison chart](/windows-server/remote/remote-desktop-services/clients/remote-desktop-app-compare#other-redirection-devices-etc) to make sure your client supports smart card redirection.
92
123
93
124
## Next steps
94
125
95
126
- Curious about other ways to keep your deployment secure? Check out [Security best practices](security-guide.md).
96
-
- Having issues connecting to Azure AD-joined VMs? [Troubleshoot connections to Azure AD-joined VMs](troubleshoot-azure-ad-connections.md).
97
-
- Want to use smart cards from outside your corporate network? Review how to setup a [KDC Proxy server](key-distribution-center-proxy.md).
127
+
- Having issues connecting to Azure AD-joined VMs? Look at [Troubleshoot connections to Azure AD-joined VMs](troubleshoot-azure-ad-connections.md).
128
+
- Having issues with in-session passwordless authentication? See [Troubleshoot WebAuthn redirection](troubleshoot-device-redirections.md#webauthn-redirection).
129
+
- Want to use smart cards from outside your corporate network? Review how to set up a [KDC Proxy server](key-distribution-center-proxy.md).
Copy file name to clipboardExpand all lines: articles/virtual-desktop/configure-device-redirections.md
+19-10Lines changed: 19 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,19 +1,19 @@
1
1
---
2
-
title: Configure device redirections - Azure
3
-
description: How to configure device redirections for Azure Virtual Desktop.
2
+
title: Configure device redirection - Azure
3
+
description: How to configure device redirection for Azure Virtual Desktop.
4
4
author: Heidilohr
5
5
ms.topic: how-to
6
-
ms.date: 08/01/2022
6
+
ms.date: 08/24/2022
7
7
ms.author: helohr
8
8
manager: femila
9
9
---
10
-
# Configure device redirections
10
+
# Configure device redirection
11
11
12
-
Configuring device redirections for your Azure Virtual Desktop environment allows you to use printers, USB devices, microphones and other peripheral devices in the remote session. Some device redirections require changes to both Remote Desktop Protocol (RDP) properties and Group Policy settings.
12
+
Configuring device redirection for your Azure Virtual Desktop environment allows you to use printers, USB devices, microphones, and other peripheral devices in the remote session. Some device redirections require changes to both Remote Desktop Protocol (RDP) properties and Group Policy settings.
13
13
14
-
## Supported device redirections
14
+
## Supported device redirection
15
15
16
-
Each client supports different device redirections. Check out [Compare the clients](/windows-server/remote/remote-desktop-services/clients/remote-desktop-app-compare) for the full list of supported device redirections for each client.
16
+
Each client supports different kinds of device redirections. Check out [Compare the clients](/windows-server/remote/remote-desktop-services/clients/remote-desktop-app-compare) for the full list of supported device redirections for each client.
17
17
18
18
>[!IMPORTANT]
19
19
>You can only enable redirections with binary settings that apply to both to and from the remote machine. The service doesn't currently support one-way blocking of redirections from only one side of the connection.
@@ -22,9 +22,9 @@ Each client supports different device redirections. Check out [Compare the clien
22
22
23
23
To learn more about customizing RDP properties for a host pool using PowerShell or the Azure portal, check out [RDP properties](customize-rdp-properties.md). For the full list of supported RDP properties, see [Supported RDP file settings](/windows-server/remote/remote-desktop-services/clients/rdp-files?context=%2fazure%2fvirtual-desktop%2fcontext%2fcontext).
24
24
25
-
## Setup device redirections
25
+
## Setup device redirection
26
26
27
-
You can use the following RDP properties and Group Policy settings to configure device redirections.
27
+
You can use the following RDP properties and Group Policy settings to configure device redirection.
28
28
29
29
### Audio input (microphone) redirection
30
30
@@ -59,7 +59,7 @@ Set the following RDP property to configure clipboard redirection:
When enabled, WebAuthn requests from the session are sent to the local PC to be completed using the local Windows Hello for Business or security devices like FIDO keys. For more information, see [In-session passwordless authentication](authentication.md#in-session-passwordless-authentication-preview).
0 commit comments