AVD What's New: Display Protection for Azure Virtual Desktop

Microsoft keeps raising the security bar for cloud-delivered Windows, and the September 2026 Azure Virtual Desktop update adds a significant new layer: Display Protection for Azure Virtual Desktop is now in public preview. Where Screen Capture Protection stops screenshots, Display Protection encrypts the display path itself — a defense-in-depth step aimed squarely at endpoint-resident threats like screen scrapers and recorders.

What’s New: Display Protection (Public Preview)

Microsoft’s announcement, added to the Azure Virtual Desktop “What’s new” page in September 2026, is concise:

Display Protection for Azure Virtual Desktop is now available in public preview. Display Protection helps protect sensitive content displayed during remote sessions by securing the display path between the session host and supported endpoint devices. Administrators can configure the required level of display protection for their host pools in the Azure portal.

Display Protection is part of the Input and Output Protection family that Microsoft has been rolling out across Windows 365 and AVD. The output side reached general availability for Windows 365 Cloud PCs in September 2026; this announcement brings the same display-path protection to Azure Virtual Desktop session hosts in preview. The input side — Windows Cloud Input Protection, which guards keyboard input against keyloggers — remains a separate, independently configured component.

How Display Protection Works

The core idea is simple but powerful: instead of just asking the client to block capture attempts, Microsoft encrypts the display stream end-to-end so there is nothing useful to capture.

• Protected display rendering — the display stream is encrypted before it leaves the session host and is decrypted and rendered only inside a trusted, protected path on the endpoint device.
• Hardware-first decryption — when a compatible GPU is available (discrete or integrated), decryption happens inside the GPU itself. Otherwise, the client falls back to protected software-based rendering.
• Trusted endpoint requirement — only supported Windows App clients that meet the required protection level can open a protected session.
• Configurable protection levels — organizations can require software-backed or hardware-backed protection, with optional HDCP enforcement on connected displays.
• Session-specific — protection applies only to the remote session being viewed and does not change behavior on the session host itself.

Because the encrypted content can only be rendered in that trusted path, malicious software running on the endpoint — screen scrapers, recording tools, malware — cannot capture usable frames of the remote session.

Display Protection vs. Screen Capture Protection

If you have been following AVD security for a while, you have likely deployed Screen Capture Protection (SCP). It is worth being precise about how the two differ, because they solve related but different problems:

In short, SCP is a policy the client honors; Display Protection is a protected channel the endpoint must be capable of. They work well together: Display Protection for the display path, SCP for broader client coverage, and watermarking as a deterrent against photographing the screen.

Protection Levels

Display Protection supports three states, which map to the RDP property value you set on the host pool:

Enabling Display Protection for AVD

For Azure Virtual Desktop, configuration happens at the host pool level through RDP properties:

1. In the Azure portal, open the target host pool.
2. Go to RDP properties → Advanced tab.
3. Add the RDP property: enableWindowsCloudIODisplayProtection:i:<value>
   • 0 — not configured
   • 1 — hardware or software enforcement
   • 2 — hardware enforcement required

This property enables server-side verification that Display Protection is enforced on the endpoint.

For comparison, Windows 365 administrators configure the equivalent setting in Microsoft Intune: Devices → Manage Windows 365 Cloud PCs → Cloud PC Settings → IO Protection → Display Protection.

One operational detail worth knowing: the setting is delivered to the endpoint through the connection (RDP) properties and cached on the device. If you change the configuration, users can select Refresh in Windows App to pull the update immediately — otherwise it can take up to 8 hours to propagate. If a connection is unexpectedly blocked shortly after enabling the feature, try Refresh before opening a support case.

Prerequisites and Supported Endpoints

Display Protection is deliberately restrictive about what endpoints may connect to a protected session. Plan for these requirements:

• Session host: AVD session host running a supported Windows client OS version or Windows Server.
• Client: Windows App version 2.0.1236.0 or newer on Windows (update from the Microsoft Store).
• Endpoint device: a physical Windows 11 device. Virtual machines are not supported as endpoints.
• Display: connect protected sessions to a display driven by the endpoint’s built-in GPU (HDMI, DisplayPort, or USB-C DisplayPort Alt Mode). DisplayLink and USB graphics adapters are not supported — they lack the protected display path and typically lack HDCP support.
• Resolution: protected sessions support up to 4K (3840 × 2160). Higher resolutions are not supported.
• Not supported clients: VMs, macOS, iOS, Android, web browsers, and Windows 365 Link devices.

Because unsupported clients cannot open a protected session, enable Display Protection only on the host pools you actually want in preview validation — a blanket tenant-wide enablement could lock users out of their sessions.

Error Codes and Troubleshooting

When Display Protection cannot be established, the connection is blocked and the user sees an error. The three codes to know:

If you hit a code not listed here, capture the activity ID and timestamp and contact Microsoft support.

Validating and Monitoring Protection

To validate the feature in your pilot:

1. From a physical Windows 11 endpoint, open Windows App (2.0.1236.0 or newer).
2. Connect to a session host with Display Protection enabled — the connection should succeed without errors.
3. Attempt to capture the screen with a screenshot tool while the session is active — the remote content should be blocked or appear blank.

For tenant-wide visibility, Cloud PC monitoring (preview) reports a DisplayProtectionState connection event on the Connection health page, which lets you confirm protected sessions are actually establishing at the intended level.

What This Means for Your AVD Security Strategy

Display Protection signals where Microsoft is taking cloud desktop security: from discouraging capture with client-side policy to preventing it with an encrypted, trusted rendering path. For organizations in regulated industries — finance, healthcare, legal, government contractors — that is a meaningful upgrade, especially for staff working from home or on managed corporate devices where data spillage risk is highest.

A few practical recommendations:

1. Pilot on a single host pool with a small user group before broad rollout.
2. Confirm endpoint readiness first — audit whether your fleet is physical Windows 11 hardware with HDCP-capable displays and current Windows App builds; older docks and USB display adapters will fail the HDCP requirement.
3. Layer, don’t replace — keep Screen Capture Protection and watermarking for broader client coverage (macOS, web, mobile) while Display Protection hardens the primary Windows endpoint path.
4. Watch the resolution limit — if users run ultrawide or multi-4K display layouts, protected sessions cap at 4K and will not render on DisplayLink-attached monitors.
5. Document the error codes — 0x110, 0x204/0x11f5, and 0x204/0x11f6 have distinct fixes; a short troubleshooting note will save your help desk time.

Looking Ahead

Display Protection for AVD is a public preview, which means Microsoft is validating the feature in real deployments before general availability. Given that the Windows 365 output-protection side reached GA this month, an AVD GA later in the year would not be surprising — but preview features should not yet be treated as production guarantees. Test it on a pilot host pool, exercise the failure modes, and give Microsoft feedback through the Windows 365/Azure Virtual Desktop feedback channels.

One thing is clear: the era of treating remote sessions as if the endpoint were trusted is ending. Display Protection is another reminder that a modern EUC security stack is about identity, device health, and the integrity of the pixels on the screen.

For ongoing coverage of Azure Virtual Desktop updates, follow the AVD What’s New series and connect with us on X at https://x.com/kkaminsk.