CA Policy does not fully respect IP restriction

Copper Contributor

Hello,

 

I'm working on using AVD and would like to restrict access to the workspace (and eventually VM) via IP. As recommended by other posts I have used CA policy to do so and it works fine with a caveat. The problem is as follows:

 

When a user logs into the workspace using RDP client for macOS from a whitelisted IP, the user is given access and is able to connect to the VM. But when the same user who is already logged into the workspace in the RDP client changes locations and is no longer using the whitelisted IP can still connect to the VM unless they log out of the workspace in the RDP client and try to log back in. This is when the IP restriction gets into effect and does not let the user log in to the workspace. 

 

Is this a normal behaviour? Can I do something in my deployment to change this behaviour so that IP restrictions are always in effect.

 

Thanks

2 Replies

@nabs93 

 

Is it possible to share the setup here?

Hi nabs93,

Please check the user's Azure Sign-in logs (portal.azure.com >Sign-in logs > tab "User sign-ins (non-interactive)"> Resource "Azure Virtual Desktop Client" > tab "Conditional Access").