YubiKey Sign-In Loops in Azure Virtual Desktop
Asked by
MellowCedar47
We use Azure Virtual Desktop to let offshore users access systems while keeping the underlying data in the UK. Conditional Access blocks access from outside the AVD environment and requires YubiKey authentication for every sign-in through several policies.
The problem is that around 5–10% of users randomly get stuck in a "Try again" loop inside AVD. Teams and Outlook are usually affected: the apps repeatedly detect the YubiKey, fail authentication immediately, and prompt the user to try again. WebAuthn is enabled on the host pool, but the issue continues even after testing different client devices, YubiKeys, and fresh FSLogix profiles.
Has anyone resolved this kind of intermittent YubiKey authentication loop? I would prefer not to disable MFA inside AVD for a small number of affected users.
Answers
I ran into a very similar problem, including some painful late-night troubleshooting. The fix was enabling Microsoft Entra authentication for RDP in the AVD single sign-on configuration. After turning that on, the YubiKey prompts stopped looping and authentication became reliable.
Reply to this answer
One thing to confirm with your compliance and legal teams is what "data staying in the UK" means in practice. If offshore users can view the information on their screens, some organizations may still consider that data to have been transferred outside the UK, even though the session and storage remain in the UK.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowCedar47: That is a fair point. We checked the arrangement with our legal team and external consultants, and they were comfortable with the approach.