Microsoft’s July 2026 updates for Azure Virtual Desktop bring two significant enhancements to the Android client experience. Both target the mobile/BYOD scenario — the space where AVD has historically had the most gaps compared to its desktop client counterparts.

External identity support on Android has reached general availability, and a new preview brings in-session passwordless authentication to the platform for the first time. Together, these updates close critical identity and security gaps for organizations extending virtual desktops to mobile users.

Android External Identity Support — Generally Available

External identity support is now generally available for the Windows App on Android. This means external users — B2B guest accounts, contractors, partners — can now access AVD desktops and RemoteApps from their Android devices using their own Entra ID guest identities.

Why This Matters

Microsoft has been methodically expanding external identity support across AVD client platforms:

  • November 2025: External identity support GA for the AVD service on Windows App for Windows
  • April 2026: Preview on macOS and Android
  • May 2026: GA for Windows App on Windows in Azure for US Government; FSLogix profile support for external identities reaches GA
  • July 2026: GA for Windows App on Android

With this update, the external identity story is now production-ready across both major mobile platforms (Android GA, macOS still in preview) and Windows. Combined with the FSLogix GA from May, external users can now have persistent profiles on pooled host pools — meaning a contractor connecting from an Android phone gets the same desktop experience as an internal employee on a Windows laptop.

How It Works

The administrative flow hasn’t changed. You still assign the external user to the app group — the same way you would for an internal user. The difference is that the external user’s identity (a B2B guest account in your Entra tenant) is now fully supported when they connect from the Windows App on Android.

Key points:

  • No additional licensing beyond standard AVD licensing
  • External users must redeem their invitation to your organization before signing in
  • FSLogix profile containers work for external identities on pooled host pools (GA since May 2026)
  • The Windows App on Android replaces the legacy Remote Desktop client

What to Check Before Deploying

If you’re planning to enable external identity access from Android devices:

  1. Verify your Conditional Access policies — ensure they account for external identities and Android platform
  2. Confirm FSLogix configuration — if you want profile persistence for external users, ensure Azure Files is configured with Entra Kerberos and the storage account app is excluded from MFA-requiring CA policies (this is the most common misconfiguration)
  3. Review app group assignments — external users need the same app group assignments as internal users
  4. Client version — ensure users are on the latest Windows App for Android (version 11.0.0.94 or later)

Android In-Session Passwordless Authentication — Preview

Alongside the external identity GA, Microsoft has introduced in-session passwordless authentication in preview for the Windows App on Android. This feature allows users to complete WebAuthn challenges within a remote session using passkeys stored on their Android device.

The Problem It Solves

When a user is connected to an AVD session and encounters an authentication challenge inside that session — say, accessing a Microsoft Entra-protected resource that requires MFA — they traditionally had limited options on mobile. On Windows, WebAuthn redirection has been available since 2022: the challenge in the remote session gets redirected to the local PC, where Windows Hello for Business or a FIDO key completes the authentication.

Now this capability is coming to Android. When a WebAuthn challenge fires inside the remote session, it’s redirected to the Android device, and the user can complete it using a software-based passkey — typically stored in Microsoft Authenticator.

How It Works

The mechanism is the same as on Windows: WebAuthn redirection. The redirectwebauthn RDP property (enabled by default) controls whether WebAuthn requests in the remote session are redirected to the local device. When a challenge is redirected, the local device’s passkey provider handles it.

Current Limitations

This is a preview, and there are important constraints:

  • Only software-based passkeys on the local Android device are supported — you can use passkeys stored in Microsoft Authenticator or similar software passkey providers
  • No physical security key support — FIDO USB keys and other hardware tokens are not supported
  • No cross-device authentication — you can’t scan a QR code to use a passkey from another device
  • Preview status — not recommended for production-critical workflows without thorough testing

Configuration

WebAuthn redirection is controlled at the host pool level:

Via Azure Portal:

  1. Navigate to your host pool → RDP Properties → Device redirection
  2. Set “WebAuthn redirection” to “WebAuthn requests in the remote session are redirected to the local computer” (this is the default)

Via Intune:

  1. Create a configuration profile for Windows 10 and later devices
  2. Navigate to Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Device and Resource Redirection
  3. Set “Do not allow WebAuthn redirection” to Disabled

Via Group Policy:

  1. Computer Configuration → Policies → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Device and Resource Redirection
  2. Set “Do not allow WebAuthn redirection” to Disabled or Not Configured

The Bigger Picture: Mobile AVD Maturity

These two updates, combined with the RDP Multipath TCP GA from earlier in July, represent a significant maturation of the Android AVD experience. Consider what’s now possible:

  • External users can connect from Android devices with full identity support (GA)
  • Passwordless authentication works in-session via passkeys on Android (Preview)
  • Session resilience is improved with RDP Multipath TCP failover (GA)

For organizations with BYOD policies or contractor-heavy workforces, the Android client is now a viable primary access method — not just a fallback when a laptop isn’t available.

Recommendations

  1. Start with external identity on Android — it’s GA, production-ready, and the administrative flow is identical to what you’re already doing for Windows clients
  2. Pilot passwordless authentication — set up a test host pool with WebAuthn redirection enabled and have Android users test with Microsoft Authenticator passkeys
  3. Update Conditional Access policies — ensure your CA policies account for Android as a platform for both internal and external identities
  4. Communicate the Windows App transition — the legacy Remote Desktop client on Android is being replaced by Windows App; ensure users are updated

What’s Still Missing

  • macOS external identity support is still in preview (not GA)
  • In-session passwordless on Android doesn’t support hardware security keys
  • No word yet on iOS/iPadOS getting similar in-session passwordless support

Summary

Microsoft continues to close the gap between desktop and mobile AVD experiences. The Android external identity GA makes it possible to extend virtual desktop access to contractors and partners on mobile devices with production-ready support. The passwordless preview, while limited to software passkeys, points toward a future where mobile AVD users can authenticate without passwords for both the session connection and in-session challenges.

For BYOD-heavy environments, these updates are worth acting on now — the external identity GA is ready for production, and the passwordless preview is worth piloting to stay ahead of the curve.

Follow Kevin Kaminski on X at https://x.com/kkaminsk for more AVD and Azure updates.