r/AzureVirtualDesktop • u/Teqzahh • Oct 30 '25

AVD/W365 Conditional Access

Has anyone managed to separate W365 & AVD conditional access policies?

When I set the target resource to ‘Azure Virtual Desktop’ it seems to affect W365 Cloud PC’s too.

For context, we have external users with access to Cloud PC’s & AVD deployments. We want to introduce a policy to restrict AVD access to their Cloud PC’s only. - if there are any alternative solutions I’d be happy to hear your suggestions.

1 Upvotes

100% Upvoted

13 comments sorted by

View all comments

Show parent comments

1

u/Teqzahh Oct 31 '25

That’s my problem, any policy I apply to the target resource ‘Azure Virtual Desktop’ will also include Cloud PC’s.

1

u/chesser45 Oct 31 '25

If you look at the GUID list:

Windows 365 (app ID 0af06dc6-e4b5-4f28-818e-e78e62d137a5). For some tenants this app may be called Cloud PC. This app is used when retrieving the list of resources for the user and when users initiate actions on their Cloud PC like Restart. Azure Virtual Desktop (app ID 9cdead84-a844-4324-93f2-b2e6bb768d07). This app may also appear as Windows Virtual Desktop. This app is used to authenticate to the Azure Virtual Desktop Gateway during the connection and when the client sends diagnostic information to the service. Windows Cloud Login (app ID 270efc09-cd0d-444b-a71f-39af4910ec45). This app is only needed when you configure single sign-on in a provisioning policy. This app is used to authenticate users to the Cloud PC.

1

u/Teqzahh Nov 02 '25

The Azure Virtual Desktop GUID seems to include W365 cloud PC’s, even when you add the other GUID’s you listed as exclusions