Forum Discussion

KevHal's avatar
KevHal
Iron Contributor
Aug 21, 2026

Windows App - you can't get there from here

Hi,

Since moving to Windows App (The issue did not occur on the old Remote Desktop client), users when they come to do the 90 day forced SSPR (Company policy), it pops up with a message that you can't get there from here, its been baffling us for a while. However in the non-interactive log, it shows Windows App is instigating Microsoft Graph to do the password reset, and this shows as being blocked, we have excluded Azure Virtual Desktop client etc from the policy but you cannot exclude graph, like I said it seems the old Remote Desktop client didn't use Microsoft Graph to do this, but Windows App does. 

 

The only workaround we have is for the user to select sign out and sign in with a different account with the same credentials (Not ideal and it causing tickets to be raised) this method does not seem to use Microsoft Graph then, they have asked if they can go back to the old Remote Desktop Client which did not have the issue. 

Anyone else come across this or any permeant solution?

 

Thanks

 

2 Replies

  • Kidd_Ip's avatar
    Kidd_Ip
    MVP
    Aug 22, 2026

    Try this:

     

    1. Exclude “Microsoft Graph Password Reset” Cloud App from the Conditional Access policy enforcing device compliance.
      • In Entra ID > Security > Conditional Access > Cloud apps > Select “Microsoft Graph Password Reset”.
      • This exclusion allows Graph‑based SSPR flows while maintaining compliance for other Graph calls.
    2. Alternatively, perform SSPR via browser (Edge/Chrome) or Windows App Web — these clients satisfy Conditional Access differently and avoid the blocked Graph call.
    3. Do not revert to the legacy Remote Desktop client since it is unsupported after 27-Mar-2026 and no longer receives security updates.

     

    https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview

     

  • Jamony's avatar
    Jamony
    MCT
    Aug 21, 2026

    This is Conditional Access blocking the password-reset flow launched by Windows App, not an AVD host-pool or Graph outage. The Windows 365 Client failure against Microsoft Graph is the clue: excluding only the AVD client does not cover a downstream resource evaluated by Conditional Access. In the affected sign-in, open the Conditional Access tab and identify the exact policy and failed grant control. Test a scoped change with a pilot group and Report-only mode; do not exclude Microsoft Graph tenant-wide. If users can complete SSPR from a compliant device or trusted location, have them reset there, then sign out of Windows App and authenticate again. Also review any policy targeting the Register security information user action. If the same policy still blocks a fully compliant device, capture the correlation ID, policy result, Windows App version, and timestamp for Microsoft support. Returning to the retired client only postpones this policy conflict.