Why RDP to an Intune Device Isn’t as Simple as Normal RDP
Intune-managed devices don’t behave like your average work PC. They’re joined to Azure AD (now Microsoft Entra ID), not a traditional on-premises domain, and that single fact changes almost everything about how Remote Desktop works.
Regular RDP assumes both machines trust the same domain controller. Intune devices skip that entirely. Instead, they authenticate through Entra ID, which means Windows’ built-in Network Level Authentication (NLA) often rejects your credentials even when they’re correct.
That’s the core reason so many IT admins hit a wall the first time they try this. The fix isn’t complicated once you understand it, but it does require a few extra configuration steps most people don’t expect.
What You’ll Need Before You Start
Get these five things sorted first, or you’ll be troubleshooting blind later.
- Admin access to the Microsoft Intune admin center
- The target device must be Entra ID joined or Entra hybrid joined
- Your connecting machine must also be Entra-registered in the same tenant
- Local admin rights on the target device (or membership in the Remote Desktop Users group)
- A stable network path to the device — same LAN, VPN, or point-to-site connection
If any of these are missing, stop and fix that first. Skipping this checklist is the single biggest reason RDP attempts to Intune devices fail.
Step-by-Step: Enabling RDP on an Intune-Managed Device
Step 1: Turn On Remote Desktop via a Configuration Profile
Go to the Intune admin center → Devices → Configuration profiles → Create profile. Choose Windows 10 and later as the platform and Settings Catalog as the profile type.
Search for the setting “Allow users to connect remotely by using Remote Desktop Services” and set it to Enabled. This setting is disabled by default on most managed builds, which surprises a lot of admins who assume RDP just works out of the box.
Assign this profile to a device group — not directly to users — since RDP access is a device-level policy.
Step 2: Open the Firewall Port
Enabling the setting above doesn’t automatically punch a hole in the Windows Defender Firewall. You need a separate firewall rule allowing inbound TCP traffic on port 3389.
Create this as another Settings Catalog profile, or push it via a PowerShell script through Intune’s script deployment feature. Plenty of admins burn an hour thinking RDP is “broken” when really the firewall is just quietly blocking the connection.
Step 3: Add Users to the Remote Desktop Users Group
Even with RDP enabled and the port open, only local admins can connect by default. To let a regular user in:
Go to Endpoint Security → Account Protection → Create Policy → Local user group membership. Add the Remote Desktop Users group, set the action to Update, and select the users or Entra groups who need access.
Step 4: Handle Network Level Authentication (NLA)
This is where most connections fail silently. NLA requires the connecting device to authenticate before the remote session even starts, and Entra-joined machines don’t always satisfy that requirement using default settings.
You have two realistic options:
Option A — Keep NLA on (recommended for security): Make sure both devices are Entra-joined in the same tenant and that you’re using an Entra account (not a local account) to connect.
Option B — Disable NLA (only for isolated/lab environments): Under Administrative Templates, find “Require user authentication for remote connections by using Network Level Authentication” and disable it. This is a real security trade-off — don’t do this on anything internet-facing.
Step 5: Build the Correct RDP File
Standard RDP connections often won’t authenticate correctly against Entra-joined devices using a plain Remote Desktop Connection window. You need a custom .rdp configuration file with the right authentication parameters set.
Checklist for the RDP file:
- ✅ Target IP address or hostname entered correctly
- ✅ “Always ask for credentials” enabled
- ✅ Use a different account:
AzureAD\your.email@company.com - ✅ Advanced tab → Server authentication set to “Warn me”
Double-click the file, enter your Entra credentials in the AzureAD\username format (not just the email address alone), and connect.
Troubleshooting: Why Your RDP Connection Still Isn’t Working
If you’ve done everything above and it’s still failing, work through these in order.
| Symptom | Likely Cause | Fix |
|---|---|---|
| “Remote Desktop can’t connect” | Firewall rule missing or not deployed | Re-check the Settings Catalog profile sync status |
| Credentials rejected repeatedly | Wrong username format | Use AzureAD\username@domain.com, not just the email |
| Connects then disconnects instantly | NLA mismatch between devices | Confirm both devices are in the same Entra tenant |
| Device sleeps before you can connect | Power settings override | Set “Turn off after” to Never under sleep settings while plugged in |
| Policy shows “applied” but RDP still off | Sync delay or conflicting GPO | Force sync from the device, check for competing policies |
| Works on LAN but not remotely | No VPN or public IP exposure | Set up point-to-site VPN or Entra Private Access instead of exposing RDP publicly |
A quick gut-check: if the device shows the RDP setting as enabled in Control Panel but disabled in the Settings app, that’s a known sync quirk. Run these two PowerShell commands directly on the device to force it:
powershell
Set-ItemProperty -Path ‘HKLM:\System\CurrentControlSet\Control\Terminal Server’ -Name “fDenyTSConnections” -Value 0
Enable-NetFirewallRule -DisplayGroup “Remote Desktop”
RDP vs. Alternatives: What Should You Actually Use?
RDP isn’t always the right tool for remotely accessing an Intune device, especially for offsite or public-network scenarios. Here’s how it stacks up.
| Method | Best For | Security Level | Setup Complexity |
|---|---|---|---|
| Direct RDP (port 3389 open) | Internal networks, quick access | Low-Moderate (exposed port risk) | Low |
| RDP over VPN | Offsite users, established IT teams | High | Moderate |
| Entra Private Access | Zero-trust orgs, no exposed ports | High | Moderate-High |
| Remote Help (Intune add-on) | Help desk support sessions | High | Low |
| Third-party tools (TeamViewer, etc.) | Ad hoc support, non-technical users | Varies by config | Low |
The honest take: exposing port 3389 directly to the internet is a bad idea regardless of how well you configure it — it’s one of the most brute-forced ports that exists. If you’re supporting remote or hybrid employees regularly, pair RDP with a VPN or look at Entra Private Access instead.
Common Mistakes That Waste Hours
These are the mistakes that show up over and over in IT forums and support tickets.
- Assigning the RDP-enable policy to a user group instead of a device group
- Forgetting the firewall rule after enabling the RDP setting
- Using a local account instead of the
AzureAD\prefixed account to authenticate - Not accounting for sleep/power settings that drop the device offline before you connect
- Trying to RDP from a personal, unmanaged device outside the tenant
- Assuming policy assignment is instant — sync can take anywhere from a few minutes to a few hours depending on check-in intervals
Quick Reference Checklist
- RDP enabled via Settings Catalog profile
- Firewall rule for port 3389 deployed
- Target user added to Remote Desktop Users group
- NLA handled (kept on with proper tenant alignment, or intentionally disabled for lab use)
- Custom RDP file created with
AzureAD\usernameformat - Device power settings prevent sleep during remote sessions
- Network path confirmed (VPN/LAN/Entra Private Access)
Frequently Asked Questions
How do I create my own RDP?
Enable Remote Desktop in Settings > System > Remote Desktop, note your PC’s IP address (ipconfig in Command Prompt), and assign a static IP to keep it fixed. For connection outside your local network, route traffic securely using a mesh VPN like Tailscale or ZeroTier instead of exposing port 3389.
How to RDP into a friend’s computer?
Have your friend turn on Remote Desktop on their PC and share their network IP or VPN address with you. Ensure their Windows Firewall allows Remote Desktop traffic, then open Remote Desktop Connection on your PC, type their IP, and enter their local account credentials when prompted.
How to RDP from your phone?
Install the official RD Client app (by Microsoft) from Google Play or App Store. Tap + to add a PC, enter your computer’s IP address and account credentials, and tap connect—you can control the desktop using touch gestures or an on-screen mouse.
How to do I give someone access to RDP?
Go to Settings > System > Remote Desktop > Remote Desktop Users, click Add, and select the user account you want to grant permissions to. Ensure that account has a set password and belongs to the local Remote Desktop Users or Administrators group.
How to see RDP users?
Open Task Manager and go to the Users tab to view currently connected active and disconnected remote sessions, or run query user in Command Prompt to see exact session names, IDs, and connection states.
What Is CertVault? Complete Guide to All 5 Platforms (2026)/Palats.io Dashboards Analytics Features: Data Guide
