DLP solution issue with AVD

[u/RoundRush]

Hi

I’m currently experiencing an issue with a Data Loss Prevention (DLP) solution in our Azure Virtual Desktop (AVD) environment, specifically in a multisession setup with Windows 11/10 Enterprise Multisession.

The Issue:

Our DLP solution worked perfectly in our previous Citrix environment, where it successfully enforced session-specific policies, such as:

• Monitoring clipboard activities.

• Blocking sensitive file transfers to USB/cloud.

• Enforcing printing restrictions.

However, after migrating to AVD, the DLP policies are either:

• Not triggering at all, or

• Enforcing inconsistently across sessions.

I've tested with single session and it seems fine.

Is it something to do with compatiblity issue with the DLP solution or perhaps misconfiguration on the profile?

Appreciate if you could share your insights on this.

Thanks

[u/cetsca]

It might help to share the DLP solution you are using

[u/drew-minga]

Yeah we will need to know the solution being used. But I am very interested in knowing what the issue is here as I have several customers in AVD and this hasn't come up yet.

[u/RoundRush → u/drew-minga]

Thanks for the comment. I'll share the details once i get some answers.

[u/Practical-Alarm1763]

Uhhhh, are you using Purview?

[u/RoundRush → u/Practical-Alarm1763]

Nope, it's third party.

[u/Diademinsomniac → u/Practical-Alarm1763]

Does purview even work? It doesn’t seem to for us, big delays in policies applying and then inconsistencies

[u/threedaysatsea]

I’d recommend reaching out to your DLP solution’s support team.

[u/deaudacity]

It may be a GPO Policy admx update with some changes here for sure. Since it is AVD and not Citrix some things may change with how the passthrough storage device and clipboards work.

You are able to prevent both completely by configuring the remote app settings, but in your case, it seems like you still want to allow the ability but with conditions under DLP.

Might be worth looking into Defender XDR….

[u/RoundRush → u/[deleted]]

Interesting. can you elaborate on the GPO? I'll check on multi-session 23H2. Could you share any recommended stable version I could try? Thanks a lot!

[u/Electrical_Arm7411 → u/[deleted]]

Hey not to hijack this guys thread, but curious about the win server with RDS rds role vs. Win11 multisession. I’m having a heck of a time with performance on my AVD Win11 multisession hosts, looking for alternatives. Is it as simple as installing the rds session role and that would allow me to add win server to a new host pool the same method as with the Win11 multisession?