This week’s Windows 365 What’s New update is a security-focused one. Display Protection for Windows 365 is now available in public preview (Week of September 7, 2026), giving administrators a new way to protect sensitive content displayed during Cloud PC sessions by securing the display path between the Cloud PC and supported endpoint devices.

This is the first piece of Microsoft’s Input and Output Protection story to land on the Windows 365 What’s New page — and for organizations dealing with regulated data, display theft via screen capture is one of the hardest insider risks to control. Let’s dig into what this preview actually does, how it differs from the Screen Capture Protection we covered in August, and what you need to know before enabling it.

What Changed

The announcement on the What’s new in Windows 365 Enterprise page reads:

Display Protection for Windows 365 is now available in public preview. Display Protection helps protect sensitive content displayed during Cloud PC sessions by securing the display path between the Cloud PC and supported endpoint devices. Administrators can configure the level of display protection in Microsoft Intune.

Full configuration and troubleshooting guidance is published in the new documentation page, Display Protection for Windows 365 and Azure Virtual Desktop.

What Display Protection Actually Is

Display Protection is a component of Output Protection, which is part of the broader Input and Output Protection feature set for Windows 365 Cloud PCs and Azure Virtual Desktop session hosts. Its job: protect display output against unauthorized screen capture and recording from endpoint-resident threats.

Where previous mitigations tried to detect or block capture attempts at the client layer, Display Protection changes the game by making the display content undisplayable outside a trusted path:

  • Protected display rendering. The display stream is encrypted end-to-end before it leaves the Cloud PC. It can be decrypted and rendered only within a trusted, protected path on a supported endpoint device.
  • Hardware or software enforcement. When compatible GPU hardware is available — discrete or integrated — decryption happens directly in the device’s GPU. Otherwise, protected software-based rendering is used.
  • Optional HDCP enforcement. Organizations can require HDCP on connected physical displays, closing the analog hole for protected content.
  • Session-specific protection. Protection applies only to the remote session being viewed and doesn’t alter behavior on the Cloud PC itself.

The “endpoint-resident threats” framing matters here. A compromised or hostile endpoint — malware, a rogue screen scraper, a user with a third-party recorder — can’t get at the pixels because the decrypted frames never exist outside the protected rendering path.

How this differs from Screen Capture Protection

In August, Windows 365 added Screen Capture Protection for web connections — a client-side capability that blanks or blocks remote session content when a screenshot, recording, or screen-share attempt is detected in supported clients.

Display Protection is a different layer:

  • Screen Capture Protection works at the client, blocking capture attempts by known capture vectors in supported clients and browsers.
  • Display Protection works at the transport and rendering layer, encrypting the display stream so capture tools never see usable content in the first place — regardless of whether a “capture attempt” is detected.

They’re complementary. Screen Capture Protection remains useful for clients Display Protection doesn’t support yet (like web browsers), while Display Protection raises the bar on the endpoints where it matters most. Watermarking remains available as a deterrent for photo-based capture.

Protection Levels

Both Windows 365 and Azure Virtual Desktop support three configuration states:

LevelBehavior
Not configuredDisplay protection isn’t enabled for the Cloud PC or session host.
Hardware or software enforcementThe Cloud PC or session host attempts a hardware-protected display channel; if hardware protection is unavailable, it falls back to software protection.
Hardware enforcement requiredA hardware-protected display channel is mandatory. If the endpoint can’t meet the requirement, the connection is blocked and the user sees an error.

For most pilots, Hardware or software enforcement is the sensible starting point — it protects sessions everywhere while still allowing software fallback on endpoints without a compatible GPU.

Configuring Display Protection

Windows 365 (Microsoft Intune)

  1. Sign in to the Microsoft Intune admin center.
  2. Go to Devices > Manage Windows 365 Cloud PCs > Cloud PC Settings.
  3. Under IO Protection, select the desired level for Display Protection.

Azure Virtual Desktop

For AVD, add the display protection RDP property in the host pool advanced settings:

  1. In the Azure portal, open the target host pool.
  2. Go to RDP properties > Advanced.
  3. Add: enableWindowsCloudIODisplayProtection:i:<value> where the value is 0 (not configured), 1 (hardware or software enforcement), or 2 (hardware enforcement required).

This property enables server-side verification that Display Protection is enforced on the endpoint.

Configuration propagation

The setting is delivered to the endpoint device through the connection (RDP) properties and cached on the device. To apply a change immediately, select Refresh in Windows App — otherwise, configuration changes can take up to 8 hours to reach an endpoint.

One practical gotcha: if a connection is unexpectedly blocked with an incompatible-client error (0x204, extended code 0x11f5) shortly after you enable or change display protection, select Refresh in Windows App to pull the latest configuration (or wait for propagation) before opening a support case.

Requirements and Support Matrix

Read these carefully — the endpoint requirements are strict:

  • Cloud PC or session host: Windows 365 Cloud PC or AVD session host running a supported Windows client OS version or Windows Server.
  • Client: Windows App on Windows, version 2.0.1236.0 or newer (update from the Microsoft Store).
  • Endpoint device: A physical Windows 11 device. Virtual machines aren’t supported as endpoints.
  • Not supported: macOS, iOS, Android, web browsers, and Windows 365 Link devices.
  • Displays: Displays connected through DisplayLink or other USB graphics adapters aren’t supported — they don’t provide the protected display path and typically lack HDCP support. Connect protected sessions to a display driven by the endpoint’s built-in GPU (HDMI, DisplayPort, or USB-C DisplayPort Alt Mode).
  • Resolution: Protected sessions support up to 4K (3840 x 2160). Higher resolutions aren’t supported.
  • Performance: Software-based protection can increase session-establishment time compared with hardware protection — another reason to prefer GPU-equipped endpoints.

Validating and Monitoring Protection

Microsoft recommends this validation flow after configuring display protection:

  1. From a physical Windows 11 endpoint, open Windows App (2.0.1236.0 or newer).
  2. Connect to a Cloud PC or session host with display protection enabled.
  3. Verify the connection succeeds without an error.
  4. Attempt a screen capture on the endpoint while the session is active — the remote session content should be blocked or appear blank.

For tenant-wide visibility, use Cloud PC monitoring (preview) and review the DisplayProtectionState connection event on the Connection health page.

Troubleshooting: Error Codes

Error codeExtended codeMeaningCommon causes
0x2040x11f5Incompatible client — the client platform or version doesn’t support display protection.Connecting from iOS, macOS, or Android; Windows App older than 2.0.1236; endpoint hasn’t received the updated configuration yet (select Refresh, or allow up to 8 hours to propagate).
0x2040x11f6Policy not met — the Cloud PC or session host rejects the connection because the client doesn’t meet the required security policy.Endpoint defaults to software-based protection; lack of GPU support or bad GPU configuration; the remote machine requires hardware-only enforcement.
0x110—HDCP requirements not met — physical display outputs don’t support the required HDCP policies.Old docking stations; USB display adapters and DisplayLink docks without HDCP; VGA cables; non-HDCP monitors.

If you hit an error that doesn’t match these codes, contact Microsoft support with the activity ID, the failure timestamp, and reproduction steps.

What Admins Should Do Now

  1. Scope a pilot. Display protection is in preview — enable it only on the Cloud PCs or session hosts you want in preview validation. Pick a security-sensitive pilot group (finance, legal, HR, or C-suite) with physical Windows 11 endpoints.

  2. Audit your endpoints. Confirm pilot endpoints run physical Windows 11 with Windows App 2.0.1236.0+ from the Microsoft Store. Check GPU support and that displays connect via the built-in GPU outputs — DisplayLink docks and USB adapters will cause failures or blocked connections.

  3. Start with hardware-or-software enforcement. Configure Devices > Manage Windows 365 Cloud PCs > Cloud PC Settings > IO Protection in Intune and select the middle level first. Move to hardware enforcement required only after validating the fleet can comply.

  4. Validate before rolling out. Run the capture-test validation flow on each endpoint type and review DisplayProtectionState in Cloud PC monitoring. Watch for the 0x204/0x110 error family and document the Refresh-in-Windows-App fix for help desk teams.

  5. Plan the broader IO Protection story. Display protection pairs with Input Protection (keyboard input vs. keyloggers) and complements existing Screen Capture Protection and watermarking. If display theft is a real risk for your org, this preview is the time to build the endpoint-hardening runbook.

Sources