Two connection-resiliency updates landed in the Week of September 14, 2026, and they are really one story: keeping Cloud PC sessions alive when the network misbehaves. Microsoft brought RDP Multipath and RDP Shortpath over TURN to Azure Government, and extended UDP RDP Shortpath and RDP Multipath to the Windows App Beta on macOS.

If you manage Cloud PCs for a commercial tenant, the macOS Beta is the part that touches your Mac users today. If you run Government workloads in GCC or GCC High, this is the week the sovereign cloud caught up on transport resiliency. Here is what changed, why it matters, and what to do about it.

What Changed

Three entries appear under the new Week of September 14, 2026 heading on the What’s new in Windows 365 Enterprise page:

  1. RDP Shortpath for public networks and RDP Multipath with UDP support in Windows App for macOS Beta (version 11.3.8, build 3048).
  2. RDP Multipath availability in Azure Government — redundant UDP transport paths now generally available; phased GA rollout of redundant TCP transport paths begins.
  3. RDP Shortpath with TURN availability in Azure Government — phased GA rollout starts, using a new dedicated relay range.

All three are about the transport layer — how pixels, input, and redirected devices actually travel between the user and their Cloud PC. None of them changed the admin portal, licensing, or the end-user experience in a disruptive way. That is the point: this is plumbing that gets better without anyone having to rebuild anything.

A Quick Refresher: Shortpath and Multipath

It helps to keep the two terms straight, because they are frequently conflated.

RDP Shortpath establishes a UDP-based transport between the local device and the Cloud PC or session host, replacing the default TCP-only path where possible. UDP gives more consistent latency and better reliability. For public networks, there are two modes, tried in order of preference:

  • A direct UDP connection via STUN (Simple Traversal Underneath NAT), negotiated between the endpoints.
  • A relayed UDP connection via TURN (Traversal Using Relays around NAT), used when a direct path cannot be established — for example behind symmetric NAT.

RDP Multipath builds on top of Shortpath. Using Interactive Connectivity Establishment (ICE), it discovers and maintains multiple transport paths at once and automatically moves traffic to an alternate path when the active one degrades. It continuously monitors available paths, so a brief network hiccup becomes a silent failover instead of a dropped session.

In practice, every RDP session still starts as a TCP reverse-connect over port 443, then attempts to upgrade to UDP. If UDP is unavailable, the session stays on TCP. Shortpath is the upgrade; Multipath is the redundancy. This week’s news extends both.

macOS Beta: UDP Shortpath and Multipath Arrive on the Mac

The headline for commercial customers is the Mac. RDP Shortpath for public networks and RDP Multipath with UDP are now available in Windows App for macOS Beta, version 11.3.8 (build 3048), for both Windows 365 and Azure Virtual Desktop.

Before this, Mac users got a solid but less resilient experience: the UDP-based Shortpath upgrade and the multi-path failover that Windows clients have enjoyed on the commercial cloud were not fully available to them. Now they are — in Beta.

What Mac users get:

  • UDP-based connectivity over RDP Shortpath for public networks, including STUN and TURN paths.
  • RDP Multipath with UDP, so the client can maintain multiple UDP paths and switch between them as network conditions change.
  • Fewer visible disruptions when switching networks, undocking, or moving between Wi-Fi and cellular.

What they do not get (yet): redundant TCP transport paths. That layer remains Windows-client-only, supported on Windows App for Windows. So on a Mac you get the UDP resiliency, but not the TCP fallback for environments that block UDP outright.

To try it, use Windows App for macOS Beta, version 11.3.8 (3048) or later and make sure your environment meets the RDP Shortpath for public networks requirements. This is a Beta from Microsoft’s RDP macOS distribution group, so treat it as a preview for evaluation rather than a fleet-wide deployment.

Azure Government: Multipath Reaches GA, TCP Rollout Begins

For GCC and GCC High tenants, the marquee item is that RDP Multipath with redundant UDP transport paths is now generally available for Windows 365 in Azure Government. At the same time, Microsoft has started the phased GA rollout of redundant TCP transport paths in Azure Government.

That combination matters because Government environments tend to be exactly where UDP is unwelcome. Locked-down networks, strict egress filtering, and symmetric NAT are the norm — the same conditions that make Multipath’s redundancy most valuable and hardest to deliver. Bringing UDP redundancy to GA and beginning the TCP rollout closes a gap where sovereign-cloud customers previously had fewer resiliency levers than commercial customers.

A few things to know:

  • UDP stays preferred. When UDP-based Shortpath is available, it remains the better transport for performance and reliability. Redundant TCP is the fallback for restrictive networks.
  • The TCP rollout is phased and quality-driven. Until it completes, redundant TCP may not be enabled consistently across every Cloud PC. Customers can try it early through the validation ring.
  • No new configuration is required when prerequisites are met — principally RDP Shortpath configured as the primary transport.

For a deeper look at how Multipath behaves across UDP and TCP paths, see our earlier write-up on RDP Multipath reaching general availability. This week is about extending that capability into the sovereign cloud.

Azure Government: Shortpath over TURN Gets a Dedicated Relay Range

The third entry is the enabler underneath everything else. The phased GA rollout of RDP Shortpath via TURN has started for Windows 365 in Azure Government, and it comes with a new dedicated TURN relay range: 20.140.236.0/22 over UDP port 3478.

TURN is the relay path that saves the day when a direct UDP connection is impossible. Because the relay uses a known IP and port, it can be explicitly allowed through firewalls — which is exactly what makes UDP feasible in locked-down Government networks where a direct path would never be negotiated.

This mirrors the commercial-cloud model, where Microsoft operates a dedicated TURN relay range of 51.5.0.0/16, separate from the previously shared Azure Communication Services range. The dedicated range is exclusive to Windows 365 and Azure Virtual Desktop traffic, which simplifies access control and avoids generic filtering.

Firewall requirements for Azure Government:

PurposeDirectionSourceDestinationPortProtocol
STUN/TURN relayoutboundCloud PC/session host VM subnet20.140.236.0/223478UDP
STUN/TURN relayoutboundClient network20.140.236.0/223478UDP

If your Government environment currently blocks all UDP, opening just this range and port is the smallest possible change that unlocks Shortpath and, by extension, Multipath.

A Documentation Nuance Worth Knowing

Microsoft’s documentation is not fully synchronized on the Azure Government TURN status. The Windows 365 What’s new page describes it as a phased GA rollout that has started. But the Azure Virtual Desktop What’s new page and the RDP Shortpath Learn article currently still describe RDP Shortpath via TURN in Azure Government as public preview, available by opting into the validation ring, with the same 20.140.236.0/22 range.

Practically, that means: the capability works now via the validation ring, and GA is rolling out. Before you build a dependency on it, confirm the current status in your own tenant and validate in a pilot. Treat the delivery as “available and progressing,” not “universally on.”

What Admins Should Do Now

  1. Check your fleet’s client versions. If you have Mac users on Windows 365 or AVD, evaluate Windows App for macOS Beta 11.3.8 (3048). Everyone else should stay current on the latest Windows App.
  2. Audit UDP egress. Shortpath and Multipath both depend on outbound UDP 3478. Confirm firewalls allow it to the STUN/TURN ranges — 51.5.0.0/16 in commercial, and the new 20.140.236.0/22 in Azure Government.
  3. For Government tenants, plan the TURN rollout deliberately. Pilot in the validation ring, verify the new relay range is reachable, then expand. Do not assume the phased TCP Multipath rollout has reached every Cloud PC yet.
  4. Verify RDP Shortpath is the primary transport. Multipath depends on it even for TCP fallback. If Shortpath is not configured, you are leaving both features on the table.
  5. Update your network documentation. If your runbooks still say UDP is unsupported in Government or on macOS, that is no longer accurate. Note the new ranges and the Beta scope.
  6. Monitor connection quality after the change. Watch for fewer disconnects and smoother recovery in Windows 365 monitoring and, where available, AVD Insights. You can confirm UDP usage on the client via the Connection Information dialog, where the transport reads UDP, UDP (Relay), or UDP (Private Network).

The Bottom Line

Microsoft spent this week making remote sessions harder to knock over — and doing it in the two places that needed it most. On the commercial cloud, macOS clients finally get the UDP Shortpath and Multipath experience Windows users have had. In Azure Government, Multipath reaches GA for UDP, TCP redundancy starts rolling out, and Shortpath over TURN gains a dedicated, allow-listable relay range. None of it requires a rebuild; most of it requires only that your firewalls and client versions are current.

Sources

Follow along on X at https://x.com/kkaminsk for weekly Windows 365 and Intune updates.