What’s up, everyone!
It’s a good idea to think about securing access to corporate data when your users are working on a virtual desktop. Currently there are some good security features available for us to implement, like;
- Various security baselines
- Screen capture protection & watermarking
- Conditional Access
- Windows Cloud Input Protection
- Device and resource redirection
- Printer redirection
- Directional clipboard
With context-based redirections Microsoft is enabling companies to change the behavior according the device state using conditional access. Now you can allow redirections for company managed and compliant devices while blocking redirections for personal or BYOD devices.
And yes! Context-based redirections also works for Azure Virtual Desktop!
What does that process look like?
Let’s zoom into the process a bit more since it might contain a couple things you don’t work with on a daily basis, like an authentication context id for example.
The process starts with the user signing into the Cloud PC. The conditional access policy we created now stores the compliance state of the local device in the selected authentication context.
The authentication context we select is the name we typed in when we created the authentication context. The ID is part of a list of IDs that is maintained by Entra ID. At first I named everything in the form of: W365 – Context-based redirections. During the writing of the blog I realized that it wasn’t the best name and I renamed it to W11/365 – Compliant devices. Why? Because I am storing the compliance state of a Windows 11 based desktop in that authentication context.
At this point we need to tie the compliance state of the device to the desired settings. That’s what we are using the Remote Connection Experience user settings for.
Step 1: Preparing your Cloud PCs
The first step is to check the configuration of the following redirections:
- Windows Components > Remote Desktop Services > Remote Desktop Session Host > Printer Redirection: Do not allow client printer redirection
- Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection: Do not allow Clipboard redirection
- Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection: Do not allow drive redirection
- Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection: Do not allow supported Plug and Play device redirection
Make sure these settings are set to Disabled.
Step 2: Create an authentication context
An authentication context is used in conditional access policies and offers an additional control to target access requirements instead of applying policies to every user/group. I like to think of it as a tag that kicks in when conditions are met.
From the Microsoft Intune admin center, select Devices, Conditional Access, Authentication Contexts. Click + New authentication context.
There is not really a lot to configure when creating an authentication context. Make sure to:
- enter a name for the authentication context: W11/365 – Compliant devices
- check the box next to Publish to apps
- select an available ID from the list: C2
Step 3: Use the authentication context in a conditional access policy
If you followed along you should still be in the Devices, Conditional Access overview. Next up on the to do list is to create a conditional access policy that applies the authentication context.
We need to configure the following:
- Give the conditional access policy a name
- Select all users and exclude any emergency accounts (breakglass accounts)
- Target resources: expand the dropdown box and select Authentication context. The pane will now show you the available authentication contexts by name. Check the box next the one that was created earlier.
- Access controls, Grant: select Grant along with Require device to be marked as compliant.
I ended up with something like this:
Step 4: Create a Cloud PC settings policy
Nowadays Cloud PC settings come in four flavors:
- Cloud PC configurations: use this policy to enable AI features on Cloud PCs.
- Windows App settings: allow or deny users the options to reset, restore and provision Cloud PCs on unmanaged devices using the MAM-enabled Windows App.
- Remote Connection Experience: We need this one! And I’ll show why down below.
- User settings: configure settings like local admin rights, reset and restore along with the frequency and optionally BCDR add-on settings.
We need to create a Remote Connection Experience Cloud PC settings policy. From the Microsoft Intune admin center, Devices, Manage Windows 365 Cloud PCs, Cloud PC Settings.
Select + Create in the ribbon followed by Remote Connection Experience (preview).
In the second step we configure the supported device redirections for drive & storage, Clipboard, Printer and USB.
- Decide which redirections you want to enable.
- Per category: change Not Configured (Default) to Authentication context: Context-based redirection for all [category information]
- Select the authentication context ID in the Entra Authentication context dropdown list.
I just configured all four settings and continued to Scope tags. Since I am not using any I left that at default and moved on to Assignments.
Add a group containing the devices you want the settings to apply to. In my demo I created an Entra group and added the Cloud PC of Ironman and used to in this assignment.
Finish up by admiring your awesome work in the Review + create step and Create the user settings policy. With that configured we reached the end of the configuration part. Let’s continue with the user experience.
The user experience
Context-based redirections is currently supported for the Windows app on Windows, Android, iOS & iPadOS, MacOS and connecting to the Cloud PC via a web browser. I signed into the Windows app on a company owned and compliant device.
I could immediately see the local drive and USB drive when I opened Windows explorer on my Cloud PC. Just for fun I copied some local text and pasted into a text file on that local drive which all just works fine. So it works like a charm from a compliant device.
That means redirections should not work if I sign into the Cloud PC using the same identity except this time I’m signing in from a non-compliant device like a standalone VM.
Immediately I can see I’ve only got access to my local drive:
In my VM I opened a text file and copied the data to the clipboard, but that content is not available in my Cloud PC:
Using the same identity I was able to manage access to the local drives and clipboard and allow them when I signed in from a compliant device while denying access from a non-compliant device.
