We use Azure Virtual Desktop to keep company data in the UK while allowing some overseas users to work remotely. Conditional Access blocks Office access outside AVD and approved locations, and three policies require YubiKey authentication for sign-ins.
Randomly, around 5–10% of users get stuck in a "Try again" loop inside the AVD session. Teams and Outlook are the most common applications affected. They repeatedly look for the YubiKey, fail immediately, and prompt the user to try again. WebAuthn is enabled on the host pool, but the problem continues across different client devices, YubiKeys, and freshly created FSLogix profiles.
Has anyone dealt with this and found a reliable fix? I would strongly prefer not to disable MFA inside AVD for a small group of affected users.
2 Answers
The fix for us was enabling Microsoft Entra authentication for the RDP connection, as described in the Azure Virtual Desktop single sign-on configuration. Once that setting was enabled, the repeated YubiKey prompts and immediate failures stopped working normally for the affected users.
One thing to double-check is the data-residency assumption. Even if the applications and stored data remain in UK-based AVD infrastructure, displaying that data to an overseas user could still be considered a transfer outside the UK. It may be worth confirming the interpretation with your legal or compliance team before relying on AVD alone for residency requirements.
We checked this with legal advisers and external consultants, and they agreed that our specific setup met the requirement.