Conditional Access Policy is not blocking Azure Virtual Desktop when accessed from Microsoft Azure Virtual Desktop Client

Question

Hi All,
In our Conditional Access Policy we are trying to block "Azure Virtual Desktop".

This policy blocks the Azure VDI when accessed from browser. However when accessed from "Microsoft Azure Virtual Desktop Client", it is allowing to access the Azure VDI.

Could you please let me know what could be missed in the CAP to configure additionally? Should i be adding a condition on client app?

Kindly share any inputs ?

Answer 1

Hi @Shanmugham, Sudha ,

There is a few apps you need to use in conditional access policies and it depends if you have AVD based on ARM or classic. Please verify you chose the correct app ids. You can look into this guide to compare with your settings:
https://learn.microsoft.com/en-us/azure/virtual-desktop/set-up-mfa

Please upvote or accept as answer if it helped.

Answer 2

I don't believe there is another 'client' to stop access from Web Browser/vs Client App.

I wonder if the client app has cached the token somehow (https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime?WT.mc_id=AZ-MVP-5004796).

What does the Conditional Access whatif say? https://learn.microsoft.com/azure/active-directory/conditional-access/what-if-tool?WT.mc_id=AZ-MVP-5004796

Answer 3

I have the same issue. I can set the conditional access to use the conditional access app control in Defender for cloud apps. I've set it to block browser and desktop apps but it only blocks the browser access.