How To RDP To An Intune Managed Device: Complete Remote Desktop Configuration Guide

Establishing a Remote Desktop Protocol (RDP) connection to a Microsoft Intune-managed, Entra ID-joined Windows endpoint requires enabling RDP policies via the Intune Settings Catalog, granting user permissions through Local User Group Membership profiles, and configuring the native client file with specific Entra ID parameters. Administrators must also open inbound TCP port 3389 through Endpoint Security Firewall profiles and append the targetisaad:i:1 flag to the RDP configuration file to bypass legacy domain authentication requirements.

Enterprise Remote Access Prerequisites & Infrastructure Audit

Connecting remotely to an endpoint managed by Microsoft Intune differs significantly from traditional Active Directory domain environments. Because cloud-native devices lack on-premises Kerberos domain controllers, authentication relies on Microsoft Entra ID (formerly Azure AD) credentials and Cloud Kerberos Trust or Web Account Manager redirection. Before deploying remote desktop access policies, verify that your environment satisfies all administrative and software prerequisites.

• Essential Gear, Licensing, & Tools:
  
  
  • Microsoft Intune tenant with Active Administrator privileges (Intune Administrator or Global Administrator role).
  • Microsoft Entra ID P1 or P2 licensing assigned to target users and administrative accounts.
  • Target endpoint running Windows 10/11 Enterprise, Pro, or Education (Version 20H2 or later recommended).
  • Connecting client computer running Remote Desktop Connection (mstsc.exe build 10.0.19041 or higher).
  • Text editor (such as Notepad) to modify connection configuration files.
• Mandatory Prerequisite Knowledge & Network Standards:
  
  
  • Understanding of Microsoft Intune Configuration Profiles and Settings Catalog workflows.
  • Familiarity with Endpoint Security policies, specifically Account Protection and Firewall management.
  • Network routing allowing TCP and UDP traffic on inbound port 3389 across managed network interfaces.
  • Knowledge of Microsoft Entra ID join states (Direct Cloud-Joined vs. Hybrid Entra ID Joined).
• Deployment Metrics & Budget Benchmarks:
  
  
  • Financial Cost: $0 in supplementary software fees (utilizes native Windows infrastructure and Microsoft 365 licensing).
  • Configuration Time: 30 to 45 minutes for initial policy creation and client setup.
  • Policy Sync Latency: 15 to 60 minutes for Intune policy propagation to target endpoints, dependent on endpoint check-in intervals.

Step-by-Step Configuration to RDP to an Intune Device

Step 1: Enable Remote Desktop Services via Intune Settings Catalog

Before any remote connection can be established, the target Windows device must be instructed to listen for incoming Remote Desktop requests. Intune enforces this state through a Configuration Profile.

1. Log in to the Microsoft Intune Admin Center.
2. Navigate to Devices, select Manage devices, choose Configuration profiles, and click Create profile.
3. Select Windows 10 and later as the platform and choose Settings catalog as the profile type. Name the profile "Device Configuration - Enable Remote Desktop" and proceed to the settings picker.
4. In the Settings Picker, search for Remote Desktop Services or Administrative Templates > System > Remote Desktop Services > Remote Desktop Session Host > Connections.
5. Enable the setting titled Allow users to connect remotely by using Remote Desktop Services. Toggle this switch to Enabled.
6. Search for Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security and locate Require user authentication for remote connections by using Network Level Authentication. Set this to Disabled if connecting from non-Entra joined endpoints, or Enabled if all connecting clients are Entra ID joined.
7. Assign the profile to the device security group containing your target Intune devices and save the deployment.

Warning: Disabling Network Level Authentication (NLA) slightly reduces early-stage handshake security on network interfaces. If your organization mandates strict NLA compliance, ensure all client machines attempting to initiate RDP sessions are fully Entra ID joined and running modern client software.

Step 2: Grant User Remote Desktop Permissions via Local Group Membership

By default, local standard user accounts on an Entra ID joined device do not have permission to log in via Remote Desktop. You must explicitly push local group assignments using Intune Endpoint Security.

1. Within the Microsoft Intune Admin Center, navigate to Endpoint security and select Account protection.
2. Click Create Policy, select Windows 10 and later as the platform, and select Local user group membership as the profile type.
3. Name the policy "Account Protection - Remote Desktop Users Group".
4. Set the Local Group dropdown menu to Remote Desktop Users.
5. Set the Group Action to Add (Update).
6. Under User Selection, choose Manual or Users/Groups, then click Add users/groups to select the specific Entra ID users or Entra ID security groups who require remote administrative access.
7. Complete the wizard and assign the policy to your target device group.

Pro-Tip: Avoid manually adding local administrative accounts on cloud-only devices. Using Intune's Local User Group Membership CSP ensures that user rights are audit-compliant, dynamic, and automatically revoked if an employee leaves the designated Entra ID security group.

Step 3: Configure Inbound Windows Firewall Rules for Port 3389

Even if the RDP service is active and user rights are granted, the local Windows Defender Firewall will block incoming connection attempts on port 3389 by default.

1. In the Microsoft Intune Admin Center, go to Endpoint security and click Firewall.
2. Click Create Policy, select Windows 10 and later as the platform, and choose Windows Defender Firewall rules as the profile type.
3. Add a new inbound rule titled Allow Inbound RDP Port 3389.
4. Set the Direction to Inbound, the Action to Allow, and the Enabled state to True.
5. Set the Protocol to TCP (and optionally create a secondary rule for UDP for enhanced performance).
6. Set the Local Port to 3389 and leave the remote port set to Any.
7. Restrict the Remote Address range to your enterprise subnet or VPN gateway IP blocks to prevent unauthorized exposure to public networks.
8. Save and assign the Firewall rule profile to the target device group.

Step 4: Create and Customize the Local RDP Connection File

Standard RDP connections fail when targeting Entra ID joined devices because the RDP client attempts to authenticate against a traditional local Security Accounts Manager (SAM) database or Active Directory domain controller. To solve this, you must construct a custom RDP file containing cloud-specific connection flags.

1. On the administrator's computer, open the native Remote Desktop Connection client (mstsc.exe).
2. Type the target device's IP address or Fully Qualified Domain Name (FQDN) into the Computer field.
3. Click Show Options, navigate to the General tab, and enter your username format as AzureAD\user@yourdomain.com.
4. Click Save As... and save the session configuration as IntuneDevice.rdp on your desktop.
5. Right-click the newly created IntuneDevice.rdp file and open it using Notepad or an equivalent text editor.
6. Scroll to the bottom of the text lines and add the following mandatory configuration string on a new line: targetisaad:i:1
7. If connecting from a machine that is not Entra ID joined, add this additional string on a new line: enablecredsspsupport:i:0
8. Save and close the text file.

Pro-Tip: The key-value pair targetisaad:i:1 explicitly instructs the Windows Remote Desktop Connection client to process authentication tokens using Microsoft Entra ID endpoints rather than attempting legacy NTLM or Kerberos domain lookups.

Step 5: Initiate the Remote Session and Authenticate

Once policies have synced to the target endpoint and your RDP configuration file is prepared, execute the connection workflow.

1. Double-click your customized IntuneDevice.rdp file.
2. A prompt will appear stating that the publisher of the remote connection cannot be identified. Click Connect.
3. When prompted for credentials, input your Entra ID login string in the format AzureAD\your.email@company.com.
4. Enter your associated Microsoft Entra ID password.
5. If Multi-Factor Authentication (MFA) or Conditional Access policies are triggered, complete the secondary authentication step (such as approving a prompt in the Microsoft Authenticator app or completing a Web Account Manager sign-in window).
6. Accept the remote device security certificate warning to launch your active remote desktop session.

Intune Remote Access & RDP Policy Parameter Specifications

The following specification reference details the administrative configurations, policy paths, and exact syntaxes required to implement secure Remote Desktop access across Intune-managed Windows endpoints.

Intune Remote Desktop Connection Failures & Remediation

Invalid Credentials or Account Lockout Error During Sign-In

• Root Cause: The connecting client is attempting to process credentials using standard Windows NTLM or local Active Directory domain controllers, which cannot parse pure Entra ID user principal names. Alternatively, the username was entered without the obligatory cloud prefix.
• Actionable Fix: Open the .rdp file in a text editor and ensure the entry targetisaad:i:1 is present on its own line. Confirm that the login string inside the client interface strictly follows the AzureAD\username@domain.com format. If using Windows Hello for Business (PIN/Biometrics) on the client machine, note that standard RDP passwords must still use the underlying Entra ID account password, or Cloud Kerberos Trust must be deployed.

Connection Blocked by Network Level Authentication (NLA)

• Root Cause: The target Intune endpoint enforces Network Level Authentication, but the connecting administrative endpoint is not Entra ID joined, lacks network visibility to public Entra ID authentication endpoints, or does not support modern Web Account Manager (WAM) prompts.
• Actionable Fix: Modify the Intune Settings Catalog policy enforcing NLA on the target endpoint. Set Require user authentication for remote connections by using Network Level Authentication to Disabled. On the client side, edit the .rdp file to include enablecredsspsupport:i:0, which bypasses CredSSP pre-authentication and presents the remote device's native Entra ID Windows login screen upon connection.

RDP Request Times Out Before Displaying Prompt

• Root Cause: The Windows Defender Firewall on the target device is dropping packets on port 3389, or an intermediate cloud gateway/network firewall is blocking TCP port 3389 traffic.
• Actionable Fix: Verify that the Intune Endpoint Security Firewall policy has successfully applied to the device by reviewing the device's policy status in the Intune Admin Center. Run an administrative PowerShell command on the target device: Test-NetConnection -ComputerName localhost -Port 3389 to verify that the local socket is listening. Check network edge devices to ensure inbound port 3389 is forwarded correctly to the device's IP address.

"The Requested Resource Is in Use" or Remote Access Denied

• Root Cause: The target user account has authenticated against Entra ID successfully, but the local Windows device security model has not granted the account remote interactive logon rights.
• Actionable Fix: Verify your Intune Account Protection policy settings. Ensure that the targeted user or security group has been successfully pushed into the local Remote Desktop Users group. You can verify local membership on the client machine by executing net localgroup "Remote Desktop Users" within an elevated Command Prompt.

Frequently Asked Questions

Can I RDP into an Intune device using Windows Hello for Business (PIN or Biometrics)?

Yes, but both the local client device and the target Intune device must be Microsoft Entra ID joined and configured with Microsoft Entra ID Cloud Kerberos Trust. Without Cloud Kerberos Trust configured, RDP sessions will refuse PIN/Biometrics and require the user to input their explicit Entra ID account password.

Why do I need to type "AzureAD" before my email address when connecting via RDP?

The AzureAD\ prefix acts as an explicit domain specifier for the Windows local Authority Security Subsystem Service (LSASS). It informs the local system authentication provider that the user account does not reside in a local SAM database or standard Active Directory domain, directing authentication to the Entra ID Cloud Identity Provider.

How do I enable RDP on Intune devices without opening port 3389 to the internet?

Opening port 3389 directly to public networks poses severe security risks. Organizations should avoid raw port exposure by routing RDP traffic through an Enterprise Virtual Private Network (VPN), leveraging Microsoft Entra Private Access, or deploying native cloud remote management tools such as Microsoft Remote Help or Azure Bastion (for Azure-hosted Virtual Desktop instances).

Does Microsoft Intune support built-in remote control without using native RDP?

Yes. Microsoft offers Remote Help, a cloud-based remote assistance solution natively integrated into Intune. Remote Help allows administrators to establish secure, authenticated screen-sharing and full control sessions over HTTPS (port 443) without opening port 3389, modifying local user groups, or editing .rdp configuration files.

Is targetisaad:i:1 compatible with non-Windows RDP clients like macOS or iOS?

The targetisaad:i:1 parameter is supported on modern versions of the Microsoft Remote Desktop App for macOS, iOS, and Android. However, native Entra ID authentication functionality and single sign-on behavior remain most stable when connecting from up-to-date Windows 10 and Windows 11 client endpoints.

Optimize Enterprise Endpoints with Modern Intune Management

Transitioning your remote management infrastructure to cloud-native endpoints eliminates dependency on legacy domain controllers while maintaining granular security boundaries. Deploy these Intune remote access policies to ensure your helpdesk administrators maintain seamless, authenticated connection vectors across all Entra ID-joined hardware assets.