Skip to main content
Get a demo Try it free

IDC names Nerdio a Major Player in Desktop as a Service & Virtual Client Computing Read the report

Blog

Endpoint compliance for virtual desktops: policies, tools, and automation

Enforce device compliance on Azure Virtual Desktop and Windows 365, prove it to auditors, and fix drift before it blocks access. Here's how.

Table of Contents

In Windows Cloud environments, Microsoft's umbrella for Windows 365 and Azure Virtual Desktop, your Conditional Access policy is blocking half your multi-session host pool, and the compliance report says the devices are "Not applicable." 

Nobody touched the policy. The hosts were compliant yesterday. Now an auditor wants a timeline showing exactly when each device drifted, and the native Microsoft Intune blade only shows you the current state.

Endpoint compliance for virtual desktops means enforcing device configuration rules on cloud-hosted sessions, then proving that enforcement held. The mechanics differ from physical endpoints in ways that surprise teams at scale, and the gaps show up exactly when an auditor is watching. 

This guide is for end-user computing (EUC) directors, Windows 365 and Azure Virtual Desktop platform owners, and the compliance gatekeepers who sign off on regulated desktop estates.

Why virtual desktop compliance breaks the physical endpoint model

On a physical laptop, data lives on the device, so compliance is about securing it. With virtual desktops, your endpoint becomes more of a window than a vault: Azure Virtual Desktop session hosts run as Azure virtual machines, files and applications live in the cloud-hosted session rather than on local hardware, and the compliance perimeter moves from the physical device to the session itself.

Microsoft Intune defines endpoint compliance as sets of rules that evaluate the configuration of managed devices and secure organizational data from devices that fall short. For cloud desktops, that definition holds, though the enforcement surface changes depending on what kind of cloud desktop you run.

Intune compliance operates in two tiers. Tenant-wide compliance policy settings decide how to treat devices with no assigned policy and set a status validity period, configurable from 1 to 120 days with a 30-day default. 

Platform-specific device compliance policies carry the actual rules: OS version, password requirements, device health, and threat levels from Microsoft Defender for Endpoint.

The payoff comes when you wire compliance results into Conditional Access, which enforces Entra ID access controls based on a device's current compliance status so targeted resources can require compliant devices before access is granted. 

This integration is how most Microsoft virtual desktop compliance strategies actually enforce policy, and the behavior differs across the three desktop types your estate likely runs.

Where compliance enforcement diverges across desktop types

Three desktop types share one Intune tenant but enforce compliance in three different shapes. Understanding the split prevents the silent enforcement failures that surface as 3 AM access blocks.

Azure Virtual Desktop single-session and Windows 365 Cloud PCs

Intune treats Azure Virtual Desktop single-session hosts the same as Windows Enterprise physical desktops. Existing configuration profiles, compliance policies, and Conditional Access apply directly. The catch: cross-regional enrollment is not supported, and Intune does not support cloned images of already-enrolled machines, including Azure Virtual Desktop VMs.

Cloud PCs also get full treatment. Intune applies security baselines, compliance policies, and updates consistently with physical devices. Microsoft's guidance is to pair Intune compliance policies with Conditional Access to block non-compliant Cloud PCs. 

One caveat applies, however: Cloud PCs do not support BitLocker, so you must exclude that setting from any compliance policy targeting them, or the device reports non-compliant for a control it can never meet.

Azure Virtual Desktop multi-session, the compliance edge case

Multi-session pooled hosts are the case many IT pros trip over. Intune manages them as shared Windows client devices, but only a restricted subset of compliance settings applies. Everything else reports "Not applicable." The supported settings are:

  • Minimum and maximum OS version, plus valid OS builds
  • Password policies (type, length, complexity, expiration, reuse history)
  • Microsoft Defender Antimalware settings and minimum version
  • Firewall, Antivirus, Antispyware, and Real-time protection
  • Microsoft Defender for Endpoint risk score

Two more constraints compound at scale. Compliance policies must target device groups only, because user-targeted compliance is not supported for multi-session. And VM deletion needs an Intune cleanup process so orphaned device records do not distort compliance reporting.

Bring your own device (BYOD) and unmanaged access

Contractors and personal devices connecting to your desktops don't need full enrollment. Windows App MAM support on iOS and Android lets you enforce app protection policies without enrolling the device, using two components: an Intune app protection policy that specifies what the client must meet, and a Conditional Access policy that gates access to Windows 365 and Azure Virtual Desktop on those criteria.

These three shapes mean a single compliance baseline rarely applies cleanly across the estate. The settings that work for a Cloud PC report "Not applicable" on a multi-session host, and that inconsistency is where drift starts.

Policies and frameworks that guide your baseline

A consensus security baseline gives you something to enforce against, instead of inventing rules per region. Many enterprise virtual desktop programs use three reference points, including CIS Benchmarks, NIST frameworks, and Microsoft's own baselines.

CIS Benchmarks are consensus-based, vendor-agnostic configuration guides. CIS Hardened Images are VM images pre-configured to meet those benchmarks, available in the Microsoft Marketplace. From there, CIS publishes hardened images for both Windows 11 Enterprise and Windows 11 Enterprise multi-session, at Level 1 (essential security) and Level 2 (high-security environments). 

Because a single operating system can carry over 200 configuration settings, hardened images pre-apply the benchmark recommendations so you start from a known-good state. Across compliance frameworks, CIS Benchmarks are recognized by PCI DSS, FISMA, and NIST.

NIST frameworks set the principles. SP 800-125 says to apply the same security policy whether an application runs on hardware or inside a hypervisor, and SP 800-207 (Zero Trust Architecture) defines the Policy Enforcement Point that governs connections between user and resource with least-privilege access. 

In a Microsoft implementation, Conditional Access functions like the Policy Enforcement Point for virtual desktop access decisions.

Microsoft's baselines translate principles into deployable settings. There's a dedicated Cloud PC security baseline (version 24H1), optimized so remote connectivity isn't broken by hardening. 

For Azure Virtual Desktop session hosts, the Cloud Adoption Framework recommends auditing OS hardening with Azure Policy machine configuration and using the Windows security baselines as a starting point.

Picking a baseline is the easy part. Keeping every host pool aligned to it across regions and business units, then proving alignment to an auditor, is the operational work.

Tools that automate enforcement, monitoring, and remediation

Manual baseline enforcement does not survive contact with a scaled estate. A 2025 configuration study compares manual and automated remediation workflows, but the core finding is consistent with what practitioners see in the field: several layers of tooling support faster detection and remediation, and they stack rather than compete:

  • Intune compliance policies are the core engine. When a device falls short, Intune can apply configurable actions such as notifying users, marking the device non-compliant after a grace period, or adding the device to a retire list; Conditional Access can then use that non-compliant state to block access. One native consideration to plan around: security settings management for unenrolled devices is not supported on Azure Virtual Desktop, which is part of why managed access workflows matter for unmanaged access scenarios.
  • Intune Remediations (formerly Proactive Remediations) pair a detection script with a remediation script. The detection script checks compliance with a specific setting; the remediation script applies the fix if the device is non-compliant. Scripts can run on a configured schedule or on demand via the admin center or the Graph API. Remediations require Windows Enterprise E3 or E5, Windows Education A3 or A5, or Windows VDA per user; Windows Enterprise E3/E5 is included in Microsoft 365 F3, E3, and E5.
  • Azure Policy handles infrastructure-level compliance, with remediation tasks for non-compliant Azure resources. The Cloud Adoption Framework uses it to configure diagnostic settings for Azure Virtual Desktop workspaces, host pools, and application groups, and to audit session host OS hardening.
  • Microsoft Defender for Cloud layers automated responses on top, with the Microsoft Cloud Security Benchmark specifying automated update enforcement for non-compliant endpoints without manual intervention.

All four layers cover enforcement and automated response. At scale, teams still have to operate them across many host pools, multiple consoles, and reporting timelines that do not always match audit deadlines. Native Intune Azure Virtual Desktop reporting can be delayed by 96 hours, and audit evidence often has to be assembled from the audit log rather than delivered as the KQL result set or CSV an assessor actually wants.

The operational gaps that cost you at audit time

Enforcement isn't where virtual desktop compliance fails. The failure modes are operational, and they cluster around five patterns that get worse as the estate grows:

  • Configuration drift. A device starts compliant, then diverges through manual changes, OS updates, local admin activity, or legacy software installs. Microsoft's own Azure Arc blog notes that lack of standardized tools and centralized visibility leads to fragmented governance, inconsistent policy enforcement, configuration drift, slow remediation, and extended exposure to vulnerabilities. If you don't track drift, your baseline becomes a document that no longer matches reality.
  • Inconsistent baselines. Windows 365 Business allows admins to configure end users as local admins on their Cloud PCs, while Windows 365 Enterprise configures them as standard users by default. If you run both, you need explicit policy governance to keep the difference intentional rather than accidental.
  • Reporting gaps. Native Intune shows current compliance state, not the timeline of when a device fell out of compliance, why, and when it returned. An assessor wants the history, not a screenshot of a paginated portal grid.
  • Fragmented governance. In Azure Virtual Desktop, the management surface spans the Azure Portal, PowerShell, and Microsoft Intune. Keeping baselines consistent across Windows 365, Microsoft Intune, and Azure Virtual Desktop means keeping those surfaces synchronized, and silent enforcement failures have to surface before they become incidents.
  • Audit cost. Evidence collection becomes expensive when engineers have to reconstruct drift, remediation, and rollback history across consoles instead of producing a repeatable audit trail.

Many teams underestimate how much of this falls on a small number of engineers chasing drift across consoles. Fixing it requires consistent automation, reporting, and rollback across the policy engines you already run.

How Nerdio Manager supports compliance operations across Windows 365 and Azure Virtual Desktop

Native Intune gives you the compliance engine. Nerdio Manager sits on top of your Microsoft tenant and extends Intune workflows rather than replacing them. 

Many enterprises run both Windows 365 and Azure Virtual Desktop, and Nerdio Manager brings Windows 365, Microsoft Intune, and Azure Virtual Desktop into one console instead of forcing admins to piece policy and compliance workflows together across separate surfaces.

Across supported Microsoft controls, admins can back up and restore Intune policies, run remediation scripts, track drift history, manage application deployment, and apply policy and automation workflows across both desktop paths from one console.

Unified remediation and evidence workflows

When a session host drifts from a configured baseline, Nerdio Manager can run assigned remediation scripts automatically. From there, Conditional Access can evaluate compliance after the remediation workflow updates the device state. 

For the reporting gap, as noted above, native Intune Azure Virtual Desktop reporting covers one pillar, compliance status, and can lag up to 96 hours. 

In contrast, Nerdio Manager adds compliance, config, app, and patch status in one view across physical and virtual endpoints; on drift specifically, it tracks change history and surfaces instant rollback for audit or remediation workflows, where native tooling gives you a current-state snapshot and a CSV export.

Image, policy, and application operations

Independent testing by Dr. Benny Tritsch puts numbers to the efficiency difference: a 2025 Tritsch benchmark found a golden image update took 88% less time and 91% fewer clicks (146 clicks down to 13) versus native Azure Virtual Desktop tools, with reimaging session hosts down 89% in clicks. 

Fewer manual steps means fewer configuration errors, which is a common upstream cause of drift. Beyond fewer clicks, Auto-Heal detects and repairs broken session hosts automatically, with up to 36% downtime reduction.

On the Windows 365 side, the platform is flat-rate, so the story here is operational, not auto-scaling. The strongest capability is Intune policy backup, restore, and multi-admin approvals. Nerdio Manager backs up and restores Intune policies, which native Intune cannot do. For an estate where a deleted policy means a reconstruction project, that's the feature teams ask for by name.

Beyond policy backup, application deployment is the other Windows 365 proof point. Nerdio Manager deploys applications to Cloud PCs in roughly 30 seconds through unified application management, compared to native Intune delivery that can take up to three hours, with detailed logging and a Run now option to force a policy re-evaluation on in-scope desktops.

Governance across both desktop paths

Role separation and baseline governance are built into Nerdio Manager as RBAC with granular roles. For managed service provider (MSP) estates, the MSP edition includes Solution Baselines that are officially CIS Certified. Those baselines package standardized security configurations, including Intune, to help detect policy drift. You can deploy CIS images for Windows and apply compliant Intune baselines from the same workflow.

The City of Corona strengthened endpoint security and improved IT operational efficiency as a result.

Importantly, the platform is built for RBAC, policy baselines, drift history, and rollback workflows, not as a security or compliance product. Virtual desktops and cloud-managed endpoints are part of your compliance strategy; Nerdio Manager supports the operational work behind that strategy.

What this means for regulated and Cybersecurity Maturity Model Certification (CMMC) workloads

Virtual desktops give regulated industries a structural compliance advantage: they can support centralized control over data access, storage, and auditing instead of relying on each physical workstation as the control point, which reduces endpoint data residency risk. 

The HIPAA Security Rule still requires the full risk analysis and technical safeguards (access control, audit controls, authentication, integrity), so virtual desktops reduce the compliance surface but don't certify anything on their own.

The Azure Well-Architected Framework for Azure Virtual Desktop recommends a SIEM system like Microsoft Sentinel for real-time monitoring of user and admin activity across the virtual desktop environment.

For MSPs serving the Defense Industrial Base, CMMC Level 2 assessment pressure is the story. Level 2 is tied to NIST SP 800-171 requirements. Contractors and their MSPs need defensible scoping, repeatable policy enforcement, and evidence collection before assessment pressure peaks.

The Azure Virtual Desktop-on-GCC High enclave model is a legitimate strategy. Per the DoD CMMC Scoping Guide, security protection assets like EDR and MFA systems are assessed within scope. Endpoint scoping decisions should be validated with your C3PAO rather than assumed from forum guidance. 

Together, Azure Government and GCC High provide government cloud environments used for regulated DIB workloads. 

Within those environments, Nerdio Manager can act as the management layer for these enclaves: standardize images and policies once, reuse those images and policy templates when onboarding new client enclaves, and apply the same policy set across every tenant. 

In practice, C3 Integrated Solutions was among the first service providers to achieve a third-party CMMC Level 2 assessment. In C3's customer story, their team notes that CIS Hardened Images offer a pre-configured security baseline and that Nerdio Manager is used to deploy those baselines and maintain the configurations over time.

Your multi-session "Not applicable" report, the orphaned device records, and the auditor's drift-timeline request all point to the same operational layer. 

Get a demo to see how Nerdio Manager works across your Windows 365 and Azure Virtual Desktop environment, or try it free in your own Azure tenant.

Frequently asked questions about endpoint compliance

Resources

Learn more about Nerdio Manager

Ready to get started?

Get a demo Try it free