Connect from Windows

Your virtual desktop is a full Windows 11 machine that you reach through Microsoft's Windows App. Here is how to connect for the first time and what to expect.

Open the Microsoft Store on your Windows PC, search for Windows App, and install it.
Open Windows App and click Sign in.
Sign in with your Azure Government (enclave) account. You do not need to enter a workspace URL.
Your assigned desktops appear in the app. Double-click a desktop to launch it.

Note: The older Remote Desktop client is no longer supported by Microsoft in Azure Government (support ended September 28). Use Windows App instead.

Connect from Mac

Confirm you are on macOS 14 or later.
Install the latest Windows App from the Mac App Store: Windows App.
In Windows App, add a workspace and enter the Azure Government workspace URL: https://rdweb.wvd.azure.us/api/arm/feeddiscovery
Sign in with your Azure Government credentials.

If a Mac connection fails after adding the workspace, make sure the Windows App is up to date. If issues continue, reach out to your CSM for assistance.

Your first sign-in

First-time access often requires a password change. Watch for the "change your Azure password to access your virtual desktop" email and complete the change before signing in.
The first launch can take a few minutes while the desktop loads. Later sign-ins are faster.
You may see more than one sign-in prompt: one for Windows App, and another when the desktop session starts. Automatic single sign-in after the app is not expected on the current platform.

Your files and profile

Your settings and preferences live in your profile, not on any single machine. Whichever desktop you sign in to, those follow you.

Files stored only on that desktop do not. That includes items on the Desktop, in Downloads, and on local disks. Before a rebuild or platform upgrade, move important files to OneDrive or the shared data drive (Z:). Large working datasets should live on Z:, not on one desktop. See Provisioning Virtual Desktops for what the shared drive is for.

Important: Software installs and machine-specific configs usually cannot move to OneDrive. Plan to reinstall those after a rebuild.

What's blocked, and why

Your virtual desktop is a controlled CUI environment, so some familiar actions are intentionally disabled:

Copying and pasting between the virtual desktop and your local computer
Transferring files to your local drives
Redirecting USB devices into the desktop
Printing to local printers

These restrictions are what generally keep the computer you connect from out of CMMC scope. CUI stays inside the desktop. The desktop also locks automatically after inactivity, and multi-factor authentication protects sign-in.

Troubleshooting

Can't connect, or error 0x5000057 in the Windows App: this usually means the app does not see an available virtual desktop for your account yet. Check that your GCC High license is active, you are listed under User access for the desktop, and the desktop's provisioning has completed.
On Mac or mobile, also confirm you added the correct Azure Government workspace URL (https://rdweb.wvd.azure.us/api/arm/feeddiscovery). On Windows, sign in to Windows App with your Azure Government account. No workspace URL is required.
Can't sign in: check for the password-change email and complete it first. If the email never arrived, contact [email protected] and include the user email and desktop name.
Desktop not listed: On Mac or mobile, refresh the workspace in Windows App, or remove and re-add it. On Windows, sign out of Windows App and sign back in with your Azure Government account.
Slow first load: first sign-in takes the longest. Give it a few minutes before retrying.
More than one sign-in prompt: Supported Virtual Desktops use a managed domain join, not Entra join. One prompt is for Windows App, and another can appear when the desktop session starts. Automatic single sign-in after the app is not expected on the current platform.
OneDrive asks for a passkey or fails to sync: Sign out of the desktop, refresh the Windows App, and reconnect, then try OneDrive again. If your tenant limits SharePoint OneDrive sync to domain-joined PCs, allow syncing beyond that restriction or add your Entra Domain Services domain GUID so Virtual Desktops can sync. If passkey prompts from a phone still fail after reconnect, contact [email protected] or your CSM. Some tenants need a Secureframe-side change.
AADSTS50011 / redirect URI does not match when opening Microsoft 365: you likely started from a commercial Microsoft 365 address (for example m365.cloud.microsoft or office.com). GCC High tenants need the .us addresses instead (see the FAQ below). This is not an enclave issue and is not limited to one user.

Frequently Asked Questions (FAQ)

I get error AADSTS50011 ("redirect URI ... does not match") when signing in to Microsoft 365 from my Virtual Desktop. How do I fix it?

This happens when you start from a commercial Microsoft 365 address (for example m365.cloud.microsoft or office.com). Your tenant is GCC High, which uses different addresses.
It is not specific to your account. Any user who starts from a commercial address can get the same error.
Use the GCC High addresses instead: Microsoft 365 home https://portal.office365.us; Outlook https://outlook.office365.us; OneDrive / SharePoint https://<tenant>-my.sharepoint.us; Teams https://gov.teams.microsoft.us.
Update any bookmarks that still point to commercial addresses. You do not need a different browser. Edge on the desktop works with these addresses.

Why do I get more than one sign-in prompt now?

Supported Virtual Desktops use a managed domain join, not Entra join. That can mean one prompt for Windows App, and another when the desktop session starts. Automatic single sign-in after the app is not expected on the current platform.

OneDrive asks for a passkey or fails to sync on the virtual desktop. What should we check?

Confirm OneDrive sign-in works after you sign out of the desktop, refresh the Windows App, and reconnect.
If SharePoint OneDrive sync is limited to domain-joined PCs, either allow syncing beyond that restriction, or add your Entra Domain Services domain GUID so sync is allowed on Virtual Desktops.
Contact [email protected] or your CSM if passkey prompts from a phone still fail after reconnect. Some tenants need a Secureframe-side change.

Will I lose data if my virtual desktop is rebuilt or migrated?

Yes, for files stored only on that desktop (Desktop, Downloads, local disks). Move important files to OneDrive or the shared Z: drive before a rebuild. See Secureframe Virtual Desktops and Provisioning Virtual Desktops.

Questions? Contact [email protected] or reach out to your CSM.

The DD2345 form asks for the IP address, MAC address, and physical address of our Virtual Desktop. What do we enter?

For IP address and MAC address, take the values from the virtual desktop network interface (NIC) properties in the Azure or desktop environment.
For physical address, use the address tied to your CAGE code registration, matching what is listed in SAM.
If your form owner expects a different convention, confirm with them before submitting.

Accessing Your Virtual Desktop