Question

A government agency requires all employees to authenticate to AD DS-joined AVD session hosts using physical smart cards issued by their PKI. Users connect from managed Windows client devices using the Windows App client. During testing, users can reach the session host logon screen but cannot present their smart card credential to the remote session — the smart card reader is not visible inside the AVD session. What must you configure to enable smart card authentication within the remote session?

Accepted Answer

Enable smart card device redirection in the host pool RDP properties and ensure the Smart Card and Certificate Propagation services are running on the session hosts

Answer

Configure a Conditional Access policy that grants access only when authentication strength requires a certificate-based method

Answer

Deploy FIDO2 security key sign-in via a Microsoft Entra ID-join configuration on the session hosts

Answer

Enable Microsoft Entra single sign-on (SSO) in the host pool RDP properties to pass client credentials to the session