RDS deployment with Azure AD Application Proxy - RDP fails (authentication to the firewall failed due to missing firewall credentials)

Barry van Dijk 26

Basically, followed this MS Article: [application-proxy-integrate-with-remote-desktop-services][1]

Installed and registered a connector following [application-proxy-add-on-premises-application][2]

Enabled the Web Client following [remote-desktop-web-client-admin][3]

Using https://

Karlie Weng 14,411 Reputation points Microsoft Vendor

2021-05-05T06:29:43.92+00:00

This is a quick note to let you know that I am currently performing research on this issue and will get back to you as soon as possible. I appreciate your patience.
If you have any updates during this process, please feel free to let me know.
Barry van Dijk 26 Reputation points

2021-05-05T06:57:54.54+00:00

Hi Karlie, thanks for the quick note. If anything changes I'll let you know, though I'm currently out of options, so anxiously waiting for any suggestions.
Kyle Barina 1 Reputation point

2021-05-05T17:07:22.747+00:00

I have an identical issue. Please let us know what you find out.
_KUL 286 Reputation points

2021-06-17T00:10:37.25+00:00

Hello!
I also set up this scheme! I also have this problem! It's just awful ... I don't even know where to look for a solution. @Barry van Dijk were you able to solve the problem?
DavidBWI 1 Reputation point

2021-08-11T15:29:15.72+00:00

I have this same setup and this same issue and need to figure out a way to resolve ASAP! Please help.

Azure AD Web Application Proxy configured for PRE AUTH and Azure MFA.

RDS 2019 GW,WEB,CB on single server.

RDSH - 2 servers publishing APP collection.

HTML5 client installed.

I can connect to the app proxy URL and get Azure MFA preauth+MFA and launch any published app using either new html5 client or old IE activex method just fine. The problem is I need to use HTML5 client for chrome support and I need multi monitor support so I have to toggle the setting to download the RDP file instead of launch in browser. This produces the firewall error in the original post above.

How do I configure this to allow launch of RDP icon for full seamless app with multi monitor support in HTML 5 client with Azure Web Application proxy in preauth mode to support Azure MFA????
Jesper Møller 1 Reputation point

2021-10-22T09:58:26.76+00:00

Did you manage to resolve this issue?

I'm having the exact same issue and I can't figure it out.
Everything is working fine when launched in the webclient, but if I download the RDP file I'm getting the exact same error as you.
Pooja Nair (MINDTREE LIMITED) 26 Reputation points Microsoft Vendor

2022-11-18T00:31:13.217+00:00

Hey, I've an identical issue. Please let us know what you find out!

11 answers

Kyle Barina 1 Reputation point

2021-07-09T18:24:43.227+00:00

So it has been my experience that you either need to use IE11 or "New" Edge IE Mode. To use this functionality with "pre-authentication" the RDS ActiveX add-on is required which only works in IE or Edge in IE Mode.

See
https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-integrate-with-remote-desktop-services#support-for-other-client-configurations

The HTML5 Web Client works fine in any browser with pre-authentication.

If you use Passthrough the classic rdweb app works in any browser. Obviously there are a number of cons to doing this vs using pre-authentication.
Please sign in to rate this answer.
Dheen Muhammadh Jaabir 21 Reputation points

2021-07-10T09:39:31.887+00:00

A customer has a requirement to publish it with Azure MFA,
I am not able to get that until I have it behind the Azure AD Authentication,

This is the problem.

It works fine with Passthrought on all then browsers but it doesnt work once I enable the AAD Authentication.

I havent tried the new Edge browser, doest it work with it?
Sign in to comment
T. Kujala 8,706 Reputation points

2022-03-06T08:01:41.933+00:00

Hi @Barry van Dijk , @Leila Kong , @_KUL , @Kyle Barina ,

RDS with the HTML5 Web Client works fine in our environment.

The problem is that you can't use local resources like printers, drives etc.

Is there any solution to get this working?

Typically users use Chrome browsers.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
WillyB-918 1 Reputation point

2022-03-11T22:57:27.547+00:00

My problem was I was using the wrong URL to access the HTML5 page and it was defaulting to the non-HTML5 version and giving me that firewall error in Non-IE browsers.

The URL should look like this for HTML5 access with Azure App Proxy:

https://yourcustomurl.msappproxy.net/RDWeb/webclient/index.html

This works in Edge, Chrome etc.
Please sign in to rate this answer.
ChrisA 1 Reputation point

2023-03-22T12:25:44.0933333+00:00

How did you change the URL to this? Simply typing results in error 404.
Sign in to comment
Robert Crichton 6 Reputation points

2022-08-21T13:16:29.603+00:00

Ok same boat here. Rdp file won’t open unless the site is accessed via Iexplore mode with theActiveX option enabled . Yikes this 2022!!

What am I doing wrong ? I ? We logged on at the AppProxy site so the users are authenticated why can’t the rdp file launch with that token. Why do I need to use Iexplore mode ? What options can I get to make it simple for our end users please
Please sign in to rate this answer.
Rutger Aaltink 0 Reputation points

2023-03-03T12:35:50.5733333+00:00

And still in 2023, it doesn't work.. :(
Sign in to comment
Rutger Aaltink 0 Reputation points

2023-03-03T12:33:54.8533333+00:00

Hello @Barry van Dijk ,

Did you ever got an working solution for this?
Try to set this up for a customer, but they want to work with mutiple screens and the webclient is not supporting this.
and the old RDP client, doesn't work, because I receive the Firewall authentication error.
Please sign in to rate this answer.
Pedro Alexandre Espirito Santo 0 Reputation points

2023-04-28T11:18:15.3033333+00:00

Hi, did you find a solution? Many thanks

ChrisA 0 Reputation points

2023-04-28T12:48:35.07+00:00

I implemented a workaround. I have put in a policy for Edge to load the AADAP URL in IE Mode on Edge to get the older ActiveX version of it to load. For Chrome I setup the Webclient URL in development mode (https://customRDWebURL.msappproxy.net/RDWeb/webclient-test/)
Sign in to comment