Remote Desktop Services (RDS) is an umbrella term for features of Microsoft [[Windows Server]] that allow users to remotely access graphical desktops and Windows applications. Remote Desktop Services has two standard architectures^[[Remote Desktop Services Architecture in Azure - Deployment Patterns and Best Practices | Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/Desktop-hosting-logical-architecture#standard-rds-deployment-architectures)]: - Basic deployment: contains the minimum number of servers to create a fully effective RDS environment, but with no redundancy. - Highly available deployment: contains all necessary components to have the highest guaranteed uptime for your RDS environment. [Supported Configurations for Remote Desktop Services | Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-supported-config) # Considerations - Do the Line-of-business applications require a different license to run in a RDS environment? # Publish Remote Desktop with Microsoft Entra application proxy - Does not require any open inbound network ports (443, 80, 3389, etc.) - Your end users must use a compatible browser to connect to RD Web or the RD Web client.^[[Publish Remote Desktop with Microsoft Entra application proxy - Microsoft Entra ID | Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/app-proxy/application-proxy-integrate-with-remote-desktop-services#support-for-other-client-configurations)] - To have all connections pass through CA policies, users are only able to access through RDWeb. Using [[MSTSC]] requires a second App Proxy for RPC connections that has passthrough enabled, which bypasses CA. - Application proxy uses the same connector as Microsoft Entra Private Access. The connector is called Microsoft Entra private network connector.^[[Add an on-premises application for remote access through application proxy in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/app-proxy/application-proxy-add-on-premises-application#install-and-verify-the-microsoft-entra-private-network-connector)] | Authentication method | Supported client configuration | | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | Pre authentication | RD Web- Windows 7/10/11 using [`Microsoft Edge Chromium IE mode`](https://learn.microsoft.com/en-us/deployedge/edge-ie-mode) + RDS ActiveX add-on | | Pre authentication | RD Web Client- HTML5-compatible web browser such as Microsoft Edge, Internet Explorer 11, Google Chrome, Safari, or Mozilla Firefox (v55.0 and later) | | Passthrough | Any other operating system that supports the Microsoft Remote Desktop application | ### Installation Instructions - Enforce TLS 1.2 on connector server.^[[How to configure connectors for Microsoft Entra Private Access - Global Secure Access | Microsoft Learn](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-connectors#transport-layer-security-tls-requirements)] - Install Microsoft Entra private network connector. # Integrate your Remote Desktop Gateway infrastructure using the Network Policy Server (NPS) extension and Microsoft Entra ID > RDG currently supports phone call and **Approve**/**Deny** push notifications from Microsoft authenticator app methods for 2FA.^[https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-nps-extension-rdg] > If your organization uses Remote Desktop Gateway and the user is registered for a TOTP code along with Authenticator push notifications, the user can't meet the MFA challenge and the Remote Desktop Gateway sign-in fails. In that case, you can override this behaviour by creating a new registry key (`OVERRIDE_NUMBER_MATCHING_WITH_OTP`) to fallback to push notifications to **Approve/Deny** with Authenticator. To perform it, follow NPS extension override number matching procedure, assuming final value will be `OVERRIDE_NUMBER_MATCHING_WITH_OTP = FALSE`.^[https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-nps-extension-rdg]