Securing AVD host access: Conditional Access vs NSG vs Azure Firewall vs just-in-time access
Verdict: Conditional Access evaluates identity, sign-in and device before access. Azure Firewall with the WindowsVirtualDesktop FQDN tag plus a UDR locks down egress. Just-in-time access time-boxes RDP. Session hosts need no public IP or inbound 3389.
| Criterion | Conditional Access | Network security group | Azure Firewall | Just-in-time VM access |
|---|---|---|---|---|
| What it controls | Identity, sign-in method, device compliance before access | Subnet or NIC traffic filtering | Outbound egress to required AVD endpoints | Time-boxed inbound RDP for troubleshooting |
| AVD use | Risk-based access to AVD apps | Keep inbound 3389 closed; no public IP | FQDN tag WindowsVirtualDesktop plus UDR next hop firewall | Open RDP on the NSG only for an approved window |
Rules
- Use Conditional Access to factor identity, sign-in method and device compliance before granting AVD access.
- Lock down egress with the WindowsVirtualDesktop FQDN tag in Azure Firewall plus a user-defined route sending traffic to the firewall.
- To use the FQDN tag, the Firewall Policy needs DNS and DNS Proxy enabled and at least one rule collection.
- Add a route with service tag WindowsVirtualDesktop and next hop Internet to prevent session drops during firewall scale-in.
- Session hosts should have no public IP and keep inbound port 3389 closed; the service uses a reverse outbound connection.
- Validate the subnet can reach the required AVD FQDNs and endpoints; this is the top cause of registration failures.
Traps
- Do not enable TLS inspection for AVD traffic on the firewall.
- An NSG rule filters traffic but cannot evaluate identity, sign-in or device; use Conditional Access for that.
- Just-in-time access, not a permanent NSG rule or a Bastion deployment, is the lightweight way to time-box RDP.