Considerations for Remote Desktop Connections in a phishing-resistant passwordless authentication deployment in Microsoft Entra ID

Organizations deploying phishing-resistant passwordless typically have a need for some of their personas to use remote desktop technology to facilitate productivity, security, or administration. The two basic use cases are:

• Initializing and authenticating a remote desktop connection session from a local client to a remote machine using phishing-resistant passwordless credentials
• Utilizing phishing-resistant passwordless credentials inside of an established remote desktop connection session

Review the specific considerations for each use case.

Evaluate support for your scenarios

If any one of the three components outlined in this document don't support your scenario, then your scenario isn't expected to work. To evaluate, consider each component for remote desktop connection session auth and in-session credential usage. Repeat this process for every scenario in your environment to understand which scenarios are expected to work and which aren't.

Example 1

For example, here's how you might evaluate if your scenario is "my Information Workers need to use their Windows devices to access Azure Virtual Desktop, need to authenticate the remote desktop connection session using a Microsoft Authenticator passkey, and use the passkey inside the remote desktop connection session in the Microsoft Edge browser":

In this example, both the remote desktop connection session itself and in-session apps can take advantage of the user’s passkey. Phishing-resistant passwordless should work broadly.

Example 2

Here's how you might evaluate if your scenario is "my Information Workers need to use their macOS devices to access Azure Virtual Desktop, need to authenticate the remote desktop connection session using a Microsoft Authenticator passkey, and use the passkey inside the remote desktop connection session":

In this example, users can use their passkey to establish the remote desktop connection session, but can't use it inside of the remote desktop connection session because the Windows App on macOS doesn't support this functionality yet. You can wait for better passkey support in the remote desktop connection client or you can switch to another credential, such as certificates with CBA.

Example 3

Here's how you might evaluate if your scenario is "my admins need to use their Windows devices to access on-premises Windows Servers, need to authenticate the remote desktop connection session using a certificate, and use the certificate inside the remote desktop connection session":

In this example, users can use their certificate to establish the remote desktop connection session and also use the certificate inside the remote desktop connection session. This scenario won't work with a passkey however, since the ___domain-joined Windows server can't use a passkey to set up a remote desktop connection session or inside the session.

Example 4

Here's how you might evaluate if your scenario is "my frontline workers need to use a Linux-based thin client to access on-premises ___domain-joined Windows Virtual Desktop Infrastructure (VDI) clients that are NOT Microsoft Entra hybrid joined, need to authenticate the remote desktop connection session using a FIDO2 security key, and use the FIDO2 security key inside the remote desktop connection session":

In this example, users likely can't use their FIDO2 security keys for remote desktop connection at all because the thin client OS and remote desktop connection client don’t support FIDO2/passkeys in every scenario required. Work with your thin client vendor to understand their roadmap for support. Additionally, plan on Microsoft Entra hybrid joining or Microsoft Entra joining the Target Platform virtual machines so that passkeys can be better supported.

Next steps

Deploy a phishing-resistant passwordless authentication deployment in Microsoft Entra ID