Use the administrative template for Azure Virtual Desktop

We've created an administrative template for Azure Virtual Desktop to configure some features of Azure Virtual Desktop. You can use the template with:

• Intune, which enables you to centrally configure session hosts that are enrolled in Intune and joined to Microsoft Entra ID or Microsoft Entra hybrid joined.

• Group Policy with Active Directory (AD), which enables you to centrally configure session hosts that are joined to an AD domain.

• Group Policy locally on each session host, but we don't recommend this to manage session hosts at scale.

You can configure the following features with the administrative template:

• Graphics related data logging
• RDP Shortpath for managed networks
• Screen capture protection
• Watermarking

Prerequisites

Before you can configure the template settings, you need to meet the following prerequisites. Select a tab for your scenario.

Intune

For Intune device configuration profile, you need the following permission:

• Assigned the Policy and Profile manager built-in role-based access control (RBAC) role.

Group Policy (AD)

For Group Policy in an Active Directory (AD) domain, you need the following permission:

• A member of the Domain Admins security group.

Local Group Policy

For local Group Policy on a session host, you need the following permission:

• A member of the local Administrators security group on each session host.

Configure the administrative template

To configure the administrative template, select a tab for your scenario and follow these steps.

Intune

1. Sign in to the Microsoft Intune admin center.

2. Create or edit a configuration profile for Windows 10 and later devices, with the Settings catalog profile type.

3. In the settings picker, browse to Administrative templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Azure Virtual Desktop. You should see settings in the Azure Virtual Desktop subcategory available for you to configure, as shown in the following screenshot:

   

4. Once you've configured settings, apply the configuration profile to your session hosts, then restart your session hosts for the settings to take effect.

Group Policy (AD)

Note

These steps assume you're using the Central Store for Group Policy.

1. Download the latest Azure Virtual Desktop administrative template files and extract the contents of the .cab file and .zip archive.

2. Copy and paste the terminalserver-avd.admx file to the Group Policy Central Store for your domain, for example \\contoso.com\SYSVOL\contoso.com\Policies\PolicyDefinitions, where contoso.com is your domain name. Then copy the terminalserver-avd.adml file to the en-us subfolder.

3. Open the Group Policy Management Console (GPMC) and create or edit a policy that targets your session hosts.

4. To verify that the Azure Virtual Desktop administrative template is available, browse to Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Azure Virtual Desktop. You should see policy settings for Azure Virtual Desktop available for you to configure, as shown in the following screenshot:

   

5. Once you've configured settings, apply the policy to your session hosts, then restart your session hosts for the settings to take effect.

Local Group Policy

1. Download the latest Azure Virtual Desktop administrative template files and extract the contents of the .cab file and .zip archive.

2. Copy and paste the terminalserver-avd.admx file to the PolicyDefinitions folder at %windir%\PolicyDefinitions. Then copy the terminalserver-avd.adml file to the en-us subfolder.

3. Open the Local Group Policy Editor console.

4. To verify that the Azure Virtual Desktop administrative template is available, browse to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Azure Virtual Desktop. You should see policy settings for Azure Virtual Desktop available for you to configure, as shown in the following screenshot:

   

5. Once you've configured settings, restart your session hosts for the settings to take effect.

Next steps

Learn how to use the administrative template with the following features:

• Graphics related data logging
• Screen capture protection
• RDP Shortpath for managed networks
• Watermarking