What Bypasses are Needed to use Azure Windows Virtual Desktop in a UCE Positive Security Model

[jebeling]

Some security conscious customers may wish to implement a positive security model where everything is blocked other than that which is explicitly allowed. This is very challenging in today's cloud focused world where authentication is often separated from service delivery and where multiple sites are used to deliver a single web page or service and where some services can be accessed via application specific client or web browser. Application specific clients also introduce the challenge of certificate pinning, use and use of background processes accessing the web with a system user rather than the logged in user.

A true positive security model invariably results in a game of "whack a mole" to identify every site, url, user-agent, and or process name (if even available) to allow in order to make a specific application or service work. As such most, if not all, cloud proxies are designed  and architected with a negative, or at best hybrid positive and negative security model in mind. UCE is architected as a hybrid and allows use of either described option, or even a pure positive security model.

What is a web administrator to do when asked to continue to implement a positive security model and still allow access to Azure Windows Virtual Desktop only for an authorized set of users?

[jebeling · Accepted solution]

Answer being formulated I've already made this work by process names for the client and by domains for web access. 😉

Urls and domains that must be allowed to use the web interface. Recommend using global bypass for wvd sites scoped by users/groups allowed to use Azure Virtual Desktop. If not global bypass, at least decryption bypass except for login sites which need to be allowed and decrypted if you wish to enforce tenant restrictions..

• Any hosts or domains to reach your IdP
• Hosts or domains associated with login to your Azure environment (likely login.microsoftonline.com at a minimum)
• All hosts in the domain wvd.microsoft.com
• All hosts in the domain prod.do.dsp.mp.microsoft.com

For simplicity of testing I implemented my positive security model in Web Filtering which means I would be decrypting WVD traffic which is pointless and adds latency. I highly recommend bypassing wvd.microsoft.com domain with global bypass in a production implementation.

  Implementing positive security model with web filtering, block all categories and block uncategorized.

Processes to bypass if you want to use the client. Recommend using global bypass by process scoped by users/groups allowed to use Azure Virtual Desktop. (In order to subscribe the client you will also need access to the subscription URL (domain wvd.microsoft.com) and login.microsoftonline.com and aacdn.msftauth.net)

• microsoft.aad.brokerplugin.exe
• msrdcw.exe
• msrdc.exe