Configure context-based redirections (Preview)

Context-based redirection enables you to control redirection behavior based on user and session conditions. By using authentication context, you can define when specific client capabilities are allowed or restricted based on factors such as user role, device compliance, or network location. This control helps ensure that sensitive data is only accessible when the session meets the required level of trust.

You can apply authentication context to control the following redirections:

  • Control clipboard redirection.
  • Control drive and storage redirection.
  • Control printer redirection.
  • Control USB redirection.

Select a tab for your product. Your selection is used for all product-specific steps in this article.

To configure context-based redirection for Windows 365:

  1. Create a Conditional Access authentication context.
  2. Create a Conditional Access policy that targets the authentication context and specifies the required sign-in conditions. Assign the policy to a user group.
  3. Create a Windows 365 Remote Connection Experience policy in Microsoft Intune that maps the authentication context to the redirections you want to control. Assign the policy to a device group that contains the target Cloud PCs.

After you configure context-based redirection, connect to a targeted Cloud PC and verify that the redirections behave as expected.

Context-based redirections support full desktop sessions in Windows App on Windows, web browsers, Android, iOS/iPadOS, and macOS. Windows 365 support is limited to Windows 365 Enterprise and Windows 365 Flex dedicated mode.

Create the Conditional Access authentication context

Authentication contexts are shared identifiers between Microsoft Entra Conditional Access and context-based redirection policies. An authentication context doesn't grant or block redirections. It enables Azure Virtual Desktop or Windows 365 to evaluate whether the Conditional Access requirements associated with that authentication context are satisfied before enabling the configured redirections.

For more information, see Conditional Access authentication context.

  1. Sign in to the Microsoft Entra admin center.
  2. Select Entra ID > Conditional Access > Authentication contexts.
  3. Select New authentication context.
  4. Enter a name and description for the authentication context.
  5. Select Publish to apps, and then select an available value from the ID list.
  6. Select Save.

Screenshot that shows Microsoft Entra admin center Authentication contexts page. The New authentication context pane shows All Managed, Compliant Devices as the name, a description for trusted sessions from managed and compliant devices, Publish to apps selected, and c8 as the ID.

In this example, an authentication context named All Managed, Compliant Devices is published for use in Conditional Access policies. The authentication context acts as a label that connects the Conditional Access requirements to context-based redirection settings. Make a note of its name and ID. You use the same authentication context when you create the Conditional Access policy and configure the product-specific redirection settings.

Create the Microsoft Entra Conditional Access policy

  1. In Conditional Access, select Policies.
  2. Select New policy.
  3. Enter a name for the policy.
  4. Under Users or workload identities, include the users or groups to which the policy applies.
  5. Under Target resources, select Authentication context, and then select the authentication context you created.
  6. Under Grant, select Grant access > Require device to be marked as compliant > Select.
  7. Set Enable policy to On.
  8. Select Create.

The following example policy requires the targeted users to connect from a compliant device:

Setting Value
Users or workload identities Targeted users or groups
Target resources Authentication contexts
Authentication context Selected authentication context
Grant access Enabled
Require device to be marked as compliant Selected
Require all selected controls Selected
Enable policy On

Screenshot that shows Microsoft Entra Conditional Access policy page for Assigned All - Managed, Compliant Devices. The policy includes all users and one authentication context. In the Grant pane, Grant access, Require device to be marked as compliant, and Require all the selected controls are selected. Enable policy is set to On.

Users connecting from compliant devices now satisfy the authentication context requirement. Next, associate the authentication context with the redirections you want to control.

Configure redirections for your product

For Windows 365, create a Remote Connection Experience policy in Intune to associate the authentication context with specific redirections.

Important

Assign the Remote Connection Experience policy to device groups that contain Cloud PCs, not user groups. Context-based redirection is enforced at the device level.

  1. Sign in to the Microsoft Intune admin center.

  2. Select Devices > Manage Windows 365 Cloud PCs > Cloud PC Settings.

  3. Select Create > Remote Connection Experience.

    Screenshot that shows Microsoft Intune admin center on the Windows 365 Settings page. The expanded Create menu lists Cloud PC configuration, Windows app customization, User settings legacy, and Remote connection experience.

  4. On the Basics page, enter a name and description, and then select Next.

  5. On the Configuration settings page, expand Device redirections. For a targeted redirection, select Authentication context: Context-based redirection.

    Screenshot that shows Microsoft Intune admin center Create setting page for a Remote Connection Experience policy. Under Device redirections, the Drive and Storage redirection menu includes Authentication context Context-based redirection for all drives.

  6. In the Entra Authentication context list that appears, select the authentication context you created. Repeat this step for each redirection you want to control.

    Screenshot that shows Microsoft Intune admin center Create setting page. Drive and Storage, Clipboard, Printer, and USB redirection are each set to Authentication context Context-based redirection, and each Entra Authentication context field is set to c8 All Managed, Compliant Devices.

  7. On the Scope tags page, select any scope tags to apply, and then select Next.

  8. On the Assignments page, select Add groups, select the device groups that contain the Cloud PCs, and then select Next.

  9. On the Review + create page, select Create.

Validate context-based redirection

  1. Connect to the targeted Cloud PC from a managed, compliant device that satisfies the Conditional Access policy.
  2. Verify that the configured redirections are available in the remote session.
  3. Connect to the same Cloud PC from a bring-your-own-device (BYOD) or noncompliant device that doesn't satisfy the policy.
  4. Verify that the configured redirections are restricted or unavailable.

If the expected behavior doesn't occur, review:

  • The Conditional Access policy assignment and authentication context.
  • The device compliance status in Microsoft Entra ID and Intune.
  • The Windows 365 Remote Connection Experience policy assignment.
  • Existing redirection policies that might override the configuration.

You can validate individual redirections by using the guidance in the following articles:

  • Last updated on