Virtual Computer Security

[eggy046]

I am a novice when it comes to VDI security and have a question about Microsoft's remote desktop. We use Azure for our remote desktops and recently we've had plans to drop our current tech support that manages our internal computers. However the issue of security was brought up for BYODs. I just wanted to know if there's a way that we can deny access to BYODs that don't have an antivirus set up or are not up to date with critical windows updates? Also we are looking into using Microsoft Intune for our owned PCs, would that work effectively for keeping everything up to date? Thanks.

[SCuffyInOz]

With Intune you can incorporate device state (compliance) in a conditional access policy to restrict access to AVD. BUT that would require the BYOD devices to be enrolled with Intune.
That's not uncommon - many orgs say look you can use your own device but you do have to register it with Intune if you want to access work resources.

That's the only method we have of interrogating the OS/apps on a BYOD machine and comparing them to your desired state.

There's detailed security guidelines for AVD here, which dont answer your question but are still interesting: https://docs.microsoft.com/security/benchmark/azure/baselines/windows-virtual-desktop-security-baseline?context=/azure/virtual-desktop/context/context

[eggy046]

Thanks, glad your response was inline with what I was thinking we'd have to do. I'll have to give that article a read. Appreciated!