Plan remote-session locking behavior for Entra-authenticated RDP

Source facts

Remote Desktop Connection supports single sign-on through Microsoft Entra authentication. The client option to use a web account for remote sign-in corresponds to the enablerdsaadauth RDP property. Microsoft states that the remote Windows lock screen does not accept Entra tokens or passwordless methods such as FIDO keys. Attempting to lock such a session disconnects it instead, with a message explaining the disconnection. Microsoft documentation.

Applicability

Check both computers against the documented operating-system and update prerequisites. Review the intended account, device join state, remote access permissions, and any policy that locks inactive sessions before assessing this sign-in route.

DSE recommendation

Include the disconnect-on-lock behavior in the pilot instructions and support notes. Ask the application owner to define an acceptable reconnect experience, including any unsaved work concerns. Review the actual session-lock policy with the endpoint team and identify who will investigate failed reconnections.

Verification

Test initial sign-in, a deliberate lock attempt, a policy-triggered lock, and the subsequent reconnect using a representative account. Record the actual client setting, user-visible messages, and application state after reconnecting. Keep each authentication method tested separate so success with one method is not recorded as proof for all methods.

Official references

Microsoft Learn: Connect to a Remote PC with Single Sign-On Using Microsoft Entra Authentication. Source reviewed September 8, 2026.