Policy

Enable Microsoft Entra ID Authentication Enforcement

Windows 11 25H2

Back to categoryOpen picker

Policy overview

Key metadata and intent for this policy.

ClassComputer
CategoryWindows Components > Remote Desktop Services > Remote Desktop Session Host > Security
Supported onAt least Windows 11 Version 24H2

Supported OS tags: Windows11

This policy setting allows you to specify whether to require server-side enforcement of Microsoft Entra ID authentication. If you enable this policy setting, all Remote Desktop Services clients must use RDS AAD Auth in order to authenticate to RD Session Host servers. This policy does not allow fallback to other authentication methods. Network Level Authentication (NLA) is required to be enabled in order for this policy to be effective. Refer to the "Require user authentication for remote connections by using Network Level Authentication" policy. If you disable or do not configure this policy setting, then Microsoft Entra ID Authentication Enforcement is not enforced.

Internal name
TS_MICROSOFT_ENTRA_ID_AUTHENTICATION_ENFORCEMENT_POLICY
Policy ID
d33193a0b6e0
Elements
0

Registry values

How enabled and disabled states update the registry.

Registry locationTypeEnabled valueDisabled value
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\EnableMicrosoftEntraIdAuthenticationEnforcementREG_DWORD
1
0

Policy elements

Inputs and configuration options exposed by this policy.

This policy has no additional user input fields.

Other policies in this category

Explore related policies at the same level.