Microsoft has rolled out an update to Windows 11 preview builds that expands security management capabilities for cloud-hosted virtual desktops. IT administrators can now configure automated session disconnect policies triggered by the physical removal of a redirected smart card in cloud environments.

This long-requested enhancement bridges a critical security gap for enterprise environments using cloud identity management, ensuring that remote workspace connections are immediately secured when physical hardware security tokens are unplugged.

Windows 11 Azure Virtual Desktop Smart Card Removal Policy Overview

With the release of recent Insider Preview builds, Microsoft has updated the Smart Card Removal Policy Service (ScPolicySvc) to support modern authentication protocols. The new functionality extends traditional smart card removal behavior to Azure Virtual Desktop (AVD) and Windows 365 environments authenticated via Microsoft Entra ID. Under this feature, when a user unplug or disconnects their redirected physical smart card from a client reader, the active cloud desktop session automatically disconnects.

Microsoft Enforces Smart Card Removal Policy for Remote Sessions

For years, enterprise IT teams relying on traditional Active Directory Domain Services (AD DS) have leveraged Group Policy to lock local workstations or sever remote desktop connections upon smart card removal. However, as organizations migrated workloads to modern cloud-native architectures, enforcing equivalent physical token behaviors across cloud-hosted desktops proved challenging.

The updated implementation specifically addresses remote desktop authentication backed by Microsoft Entra ID (RDS AAD Auth). When configured, the client system detects smart card removal events and routes notifications through the Remote Desktop Protocol (RDP) stream. The session host then executes the pre-configured policy response, severing the remote session without abruptly terminating active background applications.

Extending Security Enforcement to Microsoft Entra ID Authentication

Historically, Microsoft Entra ID authenticated remote sessions handled device redirection differently than legacy Active Directory environments. While smart card redirection allowed pass-through authentication during session startup, the underlying removal policy monitoring service often failed to track hardware state changes occurring on the client machine.

By extending the ScPolicySvc triggers to work in tandem with Microsoft Entra authentication, administrators can now apply uniform physical security compliance rules regardless of whether the user is connected to a local server or a cloud virtual machine.

Protecting Azure Virtual Desktop and Windows 365 Connections

This enhancement primarily targets organization-managed endpoints accessing high-security corporate resources via Azure Virtual Desktop host pools and Windows 365 Cloud PCs. In industries with strict regulatory compliance requirements, such as defense, healthcare, and finance, leaving an active remote workspace open on an unattended endpoint presents a significant security risk.

Automatically disconnecting the session upon token removal mitigates the risk of unauthorized physical access, ensuring that unauthenticated individuals cannot interact with sensitive cloud-hosted databases or internal network applications.

How Administrators Configure Smart Card Disconnect Rules

To implement this policy, system administrators can utilize familiar management consoles to push settings out to managed endpoints.

Group Policy and Endpoint Management Settings

Configuration can be deployed through Microsoft Intune configuration profiles or Local Group Policy Editor on the targeted endpoints. Within Group Policy, the relevant setting resides under the path:

Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Interactive logon: Smart card removal behavior

Administrators can select from several standard policy behaviors:

  • No Action: The system takes no steps when the card is removed.
  • Lock Workstation: Locks the local client system.
  • Force Logoff: Forces an immediate sign-out of the session, potentially closing unsaved work.
  • Disconnect if a Remote Desktop Services session: Disconnects the cloud session while keeping running applications preserved in the background for quick reconnection.

Impact on Zero-Trust Enterprise Workflows

Integrating physical token presence checks into cloud remote sessions directly aligns with Zero-Trust architecture principles. By treating hardware disconnection as an explicit indicator that the user has left the workstation, enterprise security teams can prevent session hijacking and minimize exposure windows for sensitive corporate assets.

Deployment Timeline across Windows 11 Insider Channels

The smart card removal policy update for Microsoft Entra ID remote sessions is currently undergoing testing within the Windows Insider Program preview builds. Microsoft is using Controlled Feature Rollouts to monitor system stability and gather feedback from enterprise administrators. Following successful preview validation, the functionality is expected to reach general availability in upcoming quality updates for supported versions of Windows 11, Windows 365, and Azure Virtual Desktop session hosts.