How do I set up Azure AD Application Proxy to publish RDWeb on a Windows Server 2025 Remote Desktop deployment

To set up Azure AD Application Proxy to publish RDWeb on a Windows Server 2025 Remote Desktop deployment, you need to ensure that the configuration aligns with the requirements and best practices for using Azure AD Application Proxy with Remote Desktop Services (RDS). Here are some steps and considerations based on your description:

1. Ensure Compatibility: Verify that both the RD Web and RD Gateway endpoints are located on the same machine with a common root. This is crucial for a single sign-on experience between the two applications.
2. Publish the RD Web Application: When publishing the RD Web application through Azure AD Application Proxy, make sure to set the following:
   • Internal URL: This should point to your RD Web endpoint (e.g., https://<rdhost>.com/RDWeb).
   • External URL: This is automatically populated but can be modified as needed.
   • Pre-authentication method: Set this to Microsoft Entra ID.
   • Translate URL headers: Disable this option to avoid issues with URL translation.
3. FQDN Consistency: Use the same internal and external Fully Qualified Domain Name (FQDN) for RD Web. If they differ, it can lead to websocket errors and connection issues.
4. Check RDP File Configuration: Ensure that the RDP files generated for RemoteApps are correctly configured to use the external URL of the RD Gateway. If the RDP files are pointing to an incorrect address, it could lead to connection issues.
5. Firewall and Port Configuration: Confirm that the necessary ports for RDS and Azure AD Application Proxy are open. Common ports include 443 for HTTPS and others specific to RDS.
6. Session Host Configuration: Make sure that the Session Host role is properly configured to allow RemoteApps to be published and accessed through the RD Web.
7. MFA Configuration: Since you are using MFA, ensure that it is correctly set up and does not interfere with the session establishment for RemoteApps.
8. Logs and Diagnostics: Check the logs on the RD Gateway and Connection Broker for any errors that might provide more insight into the connection issues. Look for any specific error codes or messages that could indicate where the problem lies.
9. Testing with Different Browsers: Sometimes, browser compatibility can affect the behavior of RD Web. Test accessing RDWeb from different browsers to see if the issue persists.

If the problem continues after checking these configurations, consider reaching out to Microsoft support for more in-depth diagnostics specific to your environment.

References:

• Publish Remote Desktop with Microsoft Entra application proxy
• Supported configurations for Remote Desktop Services

Welcome to the Microsoft Q&A Platform!

Thank you for asking your question. When publishing RDWeb through Azure AD Application Proxy on Windows Server 2025, intermittent RemoteApp connection failures are usually caused by missing prerequisites in the proxy configuration or backend RDS roles. I would like to provide you some key points to check with a sample working setup.

Key Points:

1. Enable WebSockets in Azure Application Proxy

RemoteApp/RDWeb requires WebSockets for session establishment. If disabled, connections may fail randomly.

2. Verify the Application Proxy Connector

Ensure the connector is healthy and the external RDWeb URL is reachable over HTTPS only.

3. Check Azure AD Registration & Conditional Access

Please ensure:

• RDWeb is registered as an enterprise application
• Users are assigned
• MFA requirements match your Conditional Access policies

4. Validate Certificates

RDWeb and RD Gateway must use valid, trusted SSL certificates to avoid TLS negotiation issues.

5. Review RD Gateway CAP/RAP Policies

Confirm users are explicitly allowed by connection and resource authorization policies.

6. Check Session Host & RD Broker Health

Session hosts must be reachable and the RD Broker must route sessions correctly.

7. DNS Round Robin for HA

Works for RDWeb and RD Gateway—but remember it's not intelligent load balancing.

Session persistence is handled by the RD Broker.

8. Outbound Connectivity (Port 443)

Reverse-connect transport requires outbound 443 from session hosts to Azure.

Working Configuration Example:

• RDWeb published through Azure Application Proxy with WebSockets enabled
• RDWeb registered in Azure AD with Conditional Access enforcing MFA
• RD Gateway and RDWeb split on separate servers and load-balanced via DNS round robin
• RD Broker in HA mode backed by SQL Server
• Session Hosts in collections with RemoteApps published
• Publicly trusted SSL certificates on RDWeb and RD Gateway
• Outbound 443 open from Session Hosts to Azure
• Required internal ports open between RDWeb ↔ RD Gateway ↔ RD Broker ↔ Session Hosts

References: Publish Remote Desktop with Microsoft Entra application proxy

I hope these steps above can help you align with a stable and fully supported deployment when integrating RDS with Azure AD Application Proxy and MFA.