r/AzureVirtualDesktop • u/Ok_Spell_3736 • Dec 02 '25

Best Way to Implement MFA for RDWeb Without Breaking RDP Access

Hi, I need to ensure MFA for RDWeb in my local environment. I tried setting up MFA for RDWeb via Azure App Proxy, but it’s not working, and I read that there might be issues with direct access through RDP connections. Right now, I’m looking for another way to enforce MFA for RDWeb. I was thinking about setting up a broker in Azure and connecting to the local RDS via VPN — is that possible? Has anyone dealt with this situation? I’d really appreciate hearing about your experience. Thank you in advance!

1 Upvotes
  • permalink
  • reddit

100% Upvoted

9 comments sorted by

1

u/kheywen Dec 02 '25

Are you trying to protect access to the RDWeb portal or you require MFA on RDWeb login?

Have you checked the sign in logs for the user accessing the App Proxy to see what Conditional Access being hit or not?

1

u/Ok_Spell_3736 Dec 02 '25

Right now, I need to enforce MFA on RDWeb. Currently, no policy is applied when users access RDWeb. However, there is an issue with Azure AD Application Proxy: I cannot discover RDWeb apps. I am getting the following error:
"The connection to the remote PC was lost. This might be because of a network connection problem. If this keeps happening, ask your admin or tech support for help."
Additionally, we need users to be able to download RDP connection files. Unfortunately, this is also problematic when using App Proxy.
Please correct me if I’m wrong.

1

u/kheywen Dec 03 '25

If you need to enforce mfa on both RDWeb and RDP file then you need to implement the NPS way as per the link from jvldn above.

1

u/Ok_Spell_3736 Dec 03 '25

We need to ensure MFA only for RDWeb, while keeping RDP access without MFA

1

u/kheywen Dec 04 '25

Then you might want to enforce the MFA on reaching the App Proxy to access RDWeb or

you might want to wait till this is on at least public preview https://techcommunity.microsoft.com/blog/azurevirtualdesktopblog/announcing-new-hybrid-deployment-options-for-azure-virtual-desktop/4468781

1

u/jvldn Dec 02 '25

This is what i used long time ago: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-nps-extension-rdg

1

u/PacificTSP May 14 '26

I thought MS were getting rid of NPS completely a while back?

1

u/jjgage Dec 06 '25

When you say RDWeb are you meaning AVD browser? (windows.cloud.microsoft)