Input protection (preview)

Important

Input protection is in public preview. See the Supplemental Terms of Use for Microsoft Azure Previews for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability. Visit this page to learn more about previews in Windows 365.

Overview

Windows 365 Cloud PCs already encrypt sessions and enforce identity-based authentication methods like multifactor authentication (MFA) to prevent hijacking and man-in-the-middle attacks. However, reducing the risks from threats that may reside on the connect device, such as keyloggers, can still compromise sensitive data, leading to compliance risks and financial loss.

Input protection addresses this gap with a kernel-level driver and system-level encryption that securely routes keystrokes directly to the Cloud PC, bypassing OS layers vulnerable to malware. When you enable this feature on a Cloud PC or Azure Virtual Desktop session host, it enforces a strict trust model:

  • Only protected endpoint physical devices can connect.
  • Endpoints must have the input protection MSI installed.
  • Endpoints must be registered with your organization (Microsoft Entra registered or Microsoft Entra joined).

If the MSI is missing or the endpoint isn't registered with your organization, the connection is blocked and an error message appears. This model ensures a secure channel between Windows App and the Cloud PC or Azure Virtual Desktop session host, delivering uncompromised input protection.

Supported configurations

This feature supports the following configurations:

  • Cloud PC or session host: Windows 365 Cloud PC or Azure Virtual Desktop session host running a supported Windows client OS version or Windows Server.
  • Supported clients: Windows App on Windows, when running on a physical Windows 11 device and with the input protection MSI installed.
  • Not supported clients: Virtual endpoint devices (VMs), macOS, iOS, Android, web browsers, and Windows devices that don't have the Input Protection MSI installed, including Windows 365 Link devices.

Install the input protection MSI

Prerequisites

  • The endpoint must be a physical device (virtual machines aren't supported) running Windows 11.
  • The user must have Local Admin rights to install the MSI.
  • Windows App version 2.0.1236.0 or newer. Update to the latest version from the Microsoft Store.
  • The endpoint must be registered with the same organization (Microsoft Entra tenant) that provides the protected Cloud PC or session host—that is, the device must be Microsoft Entra registered or Microsoft Entra joined. For steps, see Register the endpoint device.

Install the MSI

  1. When a user tries to connect from a physical device without the input protection MSI to a Windows 365 Cloud PC or Azure Virtual Desktop session host, the following error message appears:

    Screenshot of error message because keyboard protection client isn't installed.

  2. Download and install the appropriate MSI:

Register the endpoint device

Important

Input protection requires the connecting endpoint to be registered with the same organization (Microsoft Entra tenant) that provides the protected Cloud PC or Azure Virtual Desktop session host. The device must be Microsoft Entra registered or Microsoft Entra joined. If the endpoint isn't registered, connection validation fails and the user receives error code 0x705, which indicates that the endpoint isn't registered.

To register the endpoint, add a work or school account for the organization that provides the protected resource:

  1. On the endpoint, open Settings > Accounts > Access work or school.
  2. Select Connect, and then sign in with the credentials for the organization that provides the protected Cloud PC or session host.
  3. After registration finishes, restart Windows App or reconnect.

Note

Immediately after you register the device, the first connection attempts might fail with error code 0x702. If this happens, sign out of Windows App, remove the account from Windows App, sign in again, and then reconnect.

Configure input protection

You can configure input protection for Azure Virtual Desktop (Azure Portal) and for Windows 365 (Intune).

Note

If you previously enabled this feature by using the registry key fWCIOKeyboardInputProtection, follow these steps to remove it. Registry key support for Azure Virtual Desktop and Windows 365 will be deprecated in favor of RDP properties.

  1. Open the Registry Editor app.
  2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services.
  3. Delete fWCIOKeyboardInputProtection.

Configure for Azure Virtual Desktop

  1. Sign in to the Azure portal.

  2. Navigate to Host Pool > RDP Properties > Advanced tab.

  3. Enter enablewindowscloudiokeyboardinputprotection:i:1 as shown in the following screenshot:

    Screenshot of the enablewindowscloudiokeyboardinputprotection setting in Azure portal RDP properties.

    To stop enforcing input protection for the host pool, set the property value to enablewindowscloudiokeyboardinputprotection:i:0.

Configure for Windows 365

  1. Sign in to the Microsoft Intune admin center.

  2. Navigate to Devices > Windows 365 > Settings > Create > Remote Connection Experience (preview).

    Screenshot showing Win365 RDP Properties Remote Connection Experience.

  3. Create a Remote Connection Experience object and navigate to Configuration Settings to enable input protection.

    Screenshot showing Win365 RDP Properties Input Protection setting.

  4. After you create the Remote Connection Experience object and select Enable for input protection, the setting takes effect. 2.In the Assignments section select an Entra group containing the Cloud PC, not the user.

    To disable input protection, remove or unassign the Remote Connection Experience setting from the target Cloud PCs.

Validate protection

After you enable input protection, confirm that enforcement works as expected:

  1. From a Windows 11 physical endpoint using Windows App that has the input protection MSI installed, connect to a Cloud PC or session host that has input protection enabled. The connection succeeds.
  2. From a Windows 11 endpoint using Windows App that doesn't have the MSI installed, try to connect to the same protected resource. The connection is blocked and an error message appears.
  3. Confirm that connections to resources that don't have input protection enabled continue to work from both endpoints.

To monitor input protection across your tenant, use Cloud PC monitoring (preview) and review the KeyboardInputProtectionState connection event on the Connection health page. For steps, see Monitor Input and Output Protection.

Troubleshoot input protection

If a connection fails or the MSI doesn't install as expected, collect the following information before you contact Microsoft support:

  • MSI installation log: %TEMP%\msi*.log, generated during MSI installation.
  • Endpoint logs: C:\Program Files\Windows Cloud IO Protection\logs.
  • Client and package versions: The Windows App version and the installed MSI version.
  • Endpoint architecture: x64 or ARM64.
  • Resource type: Windows 365 Cloud PC or Azure Virtual Desktop host pool.
  • Activity ID: On a connection error, select See details, and then copy the activity ID.

If keyboard input seems unresponsive in a session, select inside the remote session window and try again before you collect logs.

  • Last updated on