Share via

Configure RDP Shortpath for public networks using Microsoft Intune and Group Policy

The Remote Desktop Protocol (RDP) Shortpath feature uses UDP to improve reliability and performance for Windows 365 connections. Windows 365 uses Interactive Connectivity Establishment (ICE) to find a network path. It can connect directly over UDP using STUN. If a direct path isn’t available, it relays traffic through Microsoft TURN servers on known IP addresses and ports. RDP Shortpath is enabled by default and should remain enabled wherever possible to ensure consistent connectivity and an optimal user experience.

Important

Keep TURN enabled unless disabling for troubleshooting. TURN provides a predictable, reliable path when direct UDP (STUN) can’t be established, for example, behind symmetric NAT or restrictive firewalls. Disabling TURN reduces successful connection rates and can force fallback to TCP, degrading performance, and reliability.

The settings described in this article update registry‑backed policies that enable or disable RDP Shortpath models. Network prerequisites must still be in place (UDP allowed; STUN/TURN endpoints reachable) for connections to succeed. After policies apply, restart the session hosts or Cloud PCs for changes to take effect. See Optimization of RDP documentation for more detail.

Configuring RDP Shortpath methods using Intune

To enable the RDP Shortpath listener on your session hosts using Microsoft Intune, use the following steps:

  1. Sign in to the Microsoft Intune admin center.

  2. Create or edit a configuration profile for Windows 10 and later devices, with the Settings catalog profile type.

  3. In the settings picker, browse to Administrative templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Azure Virtual Desktop > RDP Shortpath.

  4. Expand the Administrative Templates category.

  5. For each RDP Shortpath type, toggle the setting to Enabled or Disabled.

    a. Enabled or Not Configured: The connection attempts to use the specified network path.

    b. Disabled: The connection doesn't use this network path.

    Available RDP Shortpath Types:

    • RDP Shortpath for managed networks using NAT traversal

    • RDP Shortpath for public networks using NAT traversal (STUN)

    • RDP Shortpath for public networks using Relay (TURN)

    See RDP Documentation for more detail on these three methods.

  6. Select Next.

  7. Optional: On the Scope tags tab, select a scope tag to filter the profile. For more information about scope tags, see Use role-based access control (RBAC) and scope tags for distributed IT.

  8. On the Assignments tab, select the group containing the computers providing a remote session you want to configure, then select Next.

  9. On the Review + create tab, review the settings, then select Create.

  10. Once the policy applies to the computers providing a remote session, restart them for the settings to take effect.

Screenshot that shows RDP configuration in Intune. Diagram 1: RDP method configuration in Intune

Important

TURN is essential for performance and reliability on public networks. Enable and optimize TURN in all environments, especially on networks you don’t manage.

Configuring RDP Shortpath methods using Group Policy

To configure the RDP Shortpath using Group Policy in an Active Directory domain:

  1. Make the administrative template for Azure Virtual Desktop available in your domain by following the steps in Use the administrative template for Azure Virtual Desktop.

  2. Open the Group Policy Management console on a device you use to manage the Active Directory domain.

  3. Create or edit a policy that targets the computers providing a remote session you want to configure.

  4. Navigate to Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Azure Virtual Desktop > RDP Shortpath.

  5. Review the available RDP Shortpath types:

    • RDP Shortpath for managed networks using NAT traversal

    • RDP Shortpath for public networks using NAT traversal

    • RDP Shortpath for public networks using Relay (TURN)

  6. Double-click the policy setting Enable RDP Shortpath for managed networks to open it.

  7. Set the policy to Enabled or Disabled:

    • Enabled or Not Configured: The connection attempts to use the specified network path.

    • Disabled: The connection doesn't use this network path.

  8. Ensure the policy is applied to the session hosts, then restart them for the settings to take effect.

Note

After you configure the Group Policy, restart the Cloud PC to ensure the changes take effect.

Screenshot that shows RDP configuration options in group policy. Diagram 2: RDP method configuration in Group Policy Editor

  • Last updated on