{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-085-plan-remote-session-locking-behavior-for-entra-authenticated-rdp/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-085-plan-remote-session-locking-behavior-for-entra-authenticated-rdp/", "slug": "dse-20260908-085-plan-remote-session-locking-behavior-for-entra-authenticated-rdp", "url": "https://update.dsesecurity.com/updates/dse-20260908-085-plan-remote-session-locking-behavior-for-entra-authenticated-rdp/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-085-plan-remote-session-locking-behavior-for-entra-authenticated-rdp.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-085-plan-remote-session-locking-behavior-for-entra-authenticated-rdp/" }, "title": "Plan remote-session locking behavior for Entra-authenticated RDP", "summary": "What happens when a remote session using Microsoft Entra authentication is locked?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:15:46+00:00", "modified_at": "2026-09-08T18:20:22+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 212, "potentially_affected": "Administrators assessing Microsoft Entra authentication in Remote Desktop Connection.", "dse_recommendation": "Include the disconnect-on-lock behavior in the pilot instructions and support notes.", "primary_source": { "name": "Connect to a Remote PC with Single Sign-On Using Microsoft Entra Authentication", "url": "https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/remote-desktop-connection-single-sign-on", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Remote Desktop Connection supports single sign-on through Microsoft Entra authentication. The client option to use a web account for remote sign-in corresponds to the enablerdsaadauth RDP property. Microsoft states that the remote Windows lock screen does not accept Entra tokens or passwordless methods such as FIDO keys. Attempting to lock such a session disconnects it instead, with a message explaining the disconnection. Microsoft documentation.

\n

Applicability

\n

Check both computers against the documented operating-system and update prerequisites. Review the intended account, device join state, remote access permissions, and any policy that locks inactive sessions before assessing this sign-in route.

\n

DSE recommendation

\n

Include the disconnect-on-lock behavior in the pilot instructions and support notes. Ask the application owner to define an acceptable reconnect experience, including any unsaved work concerns. Review the actual session-lock policy with the endpoint team and identify who will investigate failed reconnections.

\n

Verification

\n

Test initial sign-in, a deliberate lock attempt, a policy-triggered lock, and the subsequent reconnect using a representative account. Record the actual client setting, user-visible messages, and application state after reconnecting. Keep each authentication method tested separate so success with one method is not recorded as proof for all methods.

\n

Official references

\n

Microsoft Learn: Connect to a Remote PC with Single Sign-On Using Microsoft Entra Authentication. Source reviewed September 8, 2026.

", "content_text": "Source facts\nRemote Desktop Connection supports single sign-on through Microsoft Entra authentication. The client option to use a web account for remote sign-in corresponds to the enablerdsaadauth RDP property. Microsoft states that the remote Windows lock screen does not accept Entra tokens or passwordless methods such as FIDO keys. Attempting to lock such a session disconnects it instead, with a message explaining the disconnection. Microsoft documentation.\nApplicability\nCheck both computers against the documented operating-system and update prerequisites. Review the intended account, device join state, remote access permissions, and any policy that locks inactive sessions before assessing this sign-in route.\nDSE recommendation\nInclude the disconnect-on-lock behavior in the pilot instructions and support notes. Ask the application owner to define an acceptable reconnect experience, including any unsaved work concerns. Review the actual session-lock policy with the endpoint team and identify who will investigate failed reconnections.\nVerification\nTest initial sign-in, a deliberate lock attempt, a policy-triggered lock, and the subsequent reconnect using a representative account. Record the actual client setting, user-visible messages, and application state after reconnecting. Keep each authentication method tested separate so success with one method is not recorded as proof for all methods.\nOfficial references\nMicrosoft Learn: Connect to a Remote PC with Single Sign-On Using Microsoft Entra Authentication. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nRemote Desktop Connection supports single sign-on through Microsoft Entra authentication. The client option to use a web account for remote sign-in corresponds to the enablerdsaadauth RDP property. Microsoft states that the remote Windows lock screen does not accept Entra tokens or passwordless methods such as FIDO keys. Attempting to lock such a session disconnects it instead, with a message explaining the disconnection. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/remote-desktop-connection-single-sign-on).\n\n## Applicability\n\nCheck both computers against the documented operating-system and update prerequisites. Review the intended account, device join state, remote access permissions, and any policy that locks inactive sessions before assessing this sign-in route.\n\n## DSE recommendation\n\nInclude the disconnect-on-lock behavior in the pilot instructions and support notes. Ask the application owner to define an acceptable reconnect experience, including any unsaved work concerns. Review the actual session-lock policy with the endpoint team and identify who will investigate failed reconnections.\n\n## Verification\n\nTest initial sign-in, a deliberate lock attempt, a policy-triggered lock, and the subsequent reconnect using a representative account. Record the actual client setting, user-visible messages, and application state after reconnecting. Keep each authentication method tested separate so success with one method is not recorded as proof for all methods.\n\n## Official references\n\n[Microsoft Learn: Connect to a Remote PC with Single Sign-On Using Microsoft Entra Authentication](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/remote-desktop-connection-single-sign-on). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-085-plan-remote-session-locking-behavior-for-entra-authenticated-rdp/", "url": "https://update.dsesecurity.com/updates/dse-20260908-085-plan-remote-session-locking-behavior-for-entra-authenticated-rdp/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-085-plan-remote-session-locking-behavior-for-entra-authenticated-rdp/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Plan remote-session locking behavior for Entra-authenticated RDP", "item": "https://update.dsesecurity.com/updates/dse-20260908-085-plan-remote-session-locking-behavior-for-entra-authenticated-rdp/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-085-plan-remote-session-locking-behavior-for-entra-authenticated-rdp/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-085-plan-remote-session-locking-behavior-for-entra-authenticated-rdp/", "url": "https://update.dsesecurity.com/updates/dse-20260908-085-plan-remote-session-locking-behavior-for-entra-authenticated-rdp/", "headline": "Plan remote-session locking behavior for Entra-authenticated RDP", "description": "What happens when a remote session using Microsoft Entra authentication is locked?", "abstract": "What happens when a remote session using Microsoft Entra authentication is locked?", "articleBody": "Source facts\nRemote Desktop Connection supports single sign-on through Microsoft Entra authentication. The client option to use a web account for remote sign-in corresponds to the enablerdsaadauth RDP property. Microsoft states that the remote Windows lock screen does not accept Entra tokens or passwordless methods such as FIDO keys. Attempting to lock such a session disconnects it instead, with a message explaining the disconnection. Microsoft documentation.\nApplicability\nCheck both computers against the documented operating-system and update prerequisites. Review the intended account, device join state, remote access permissions, and any policy that locks inactive sessions before assessing this sign-in route.\nDSE recommendation\nInclude the disconnect-on-lock behavior in the pilot instructions and support notes. Ask the application owner to define an acceptable reconnect experience, including any unsaved work concerns. Review the actual session-lock policy with the endpoint team and identify who will investigate failed reconnections.\nVerification\nTest initial sign-in, a deliberate lock attempt, a policy-triggered lock, and the subsequent reconnect using a representative account. Record the actual client setting, user-visible messages, and application state after reconnecting. Keep each authentication method tested separate so success with one method is not recorded as proof for all methods.\nOfficial references\nMicrosoft Learn: Connect to a Remote PC with Single Sign-On Using Microsoft Entra Authentication. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:15:46+00:00", "dateModified": "2026-09-08T18:20:22+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-085-plan-remote-session-locking-behavior-for-entra-authenticated-rdp/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-085-plan-remote-session-locking-behavior-for-entra-authenticated-rdp/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Plan remote-session locking behavior for Entra-authenticated RDP" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 212, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Connect to a Remote PC with Single Sign-On Using Microsoft Entra Authentication", "url": "https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/remote-desktop-connection-single-sign-on" } } ] } }