Context-Based Redirection for Windows 365: Smarter Control Over Cloud PC Redirections

• Windows 365
• Microsoft Intune
• Microsoft Entra ID
• Conditional Access
• Preview feature

Why redirections deserve a second look

A Cloud PC keeps corporate data in the cloud, but clipboard, drive, printer and USB redirection can quietly carry that data back to whatever device the user connects from. Until now, these settings were largely all-or-nothing for a Cloud PC: if copy and paste was on, it was on for a compliant corporate laptop and for an unmanaged personal PC alike.

Context-based redirection, currently in Preview, changes that. Windows 365 decides at connection time whether each redirection is enabled, based on whether the session meets the Microsoft Entra Conditional Access requirements you define, such as device compliance.

In this post we walk through how the feature works and how to configure it end to end, using screenshots from a hands-on lab built around a simple rule: only managed, compliant devices get redirections.

The infographic below sums up the idea: the same Cloud PC offers clipboard, drive and USB redirection to a managed, compliant device and blocks them on a personal one. It uses c1 as its example authentication context, while the lab later in this post uses c8.

What context-based redirection is

Context-based redirection ties a redirection to a Microsoft Entra authentication context, so the redirection only switches on when the connecting session meets the Conditional Access policy behind that context. Instead of a fixed on or off value, the Intune setting effectively says: enable this redirection only when context X is satisfied.

An authentication context is just a shared label. It does not allow or block anything on its own; Conditional Access defines the requirements, and Windows 365 checks them before it enables the redirection.

Four redirections can be controlled this way, each with its own setting in the Intune Remote Connection Experience policy:

How it works

At connection time, Windows 365 checks whether the session satisfies the Conditional Access policy tied to an authentication context, and only then enables the redirections mapped to that context.

1. A user connects to the Cloud PC from a supported client, such as Windows App or a web browser.
2. Windows 365 reads the authentication context set on each redirection in the Remote Connection Experience policy (c8 in the lab).
3. Microsoft Entra evaluates the Conditional Access policy that targets that context. In the lab, the requirement is that the connecting device is marked as compliant.
4. If the requirement is met, the redirections mapped to the context are available in the session. If not, they are restricted or unavailable.

Because the check is ordinary Conditional Access, the signals you already use can drive it. Microsoft’s article names user role, device compliance and network location as examples.

The two policies reach different audiences: the Conditional Access policy is assigned to users, while the Intune policy is assigned to the device group holding the Cloud PCs. The authentication context is the only link between them. Any redirection left on Not configured (Default) is untouched, so system defaults apply unless another applicable policy sets a value.

What you need before you start

Context-based redirection is limited to Windows 365 Enterprise and Windows 365 Flex dedicated mode, and it covers full desktop sessions. Microsoft’s article does not mention Frontline or Business, so confirm support before planning a rollout on those. Supported clients for full desktop sessions are Windows App on Windows, web browsers, Android, iOS/iPadOS and macOS.

Three building blocks make it work, and each is assigned to a different kind of target:

Two practical notes. Conditional Access itself needs a Microsoft Entra ID P1 licence or a suite that includes it; Microsoft’s article does not discuss licensing, so confirm with your licensing team. And the compliance check applies to the device the user connects from, so those devices must be Intune-managed with a compliance policy in place.

Configuration walkthrough

The lab goal was simple: enable drive, clipboard, printer and USB redirection only for sessions that come from a managed, compliant device. It takes three steps, in this order.

Step 1: Create the authentication context

1. In the Microsoft Entra admin center, go to Entra ID > Conditional Access > Authentication contexts.
2. Select New authentication context.
3. Enter a name and description. The lab used “Trusted W365 Devices” and “Trusted sessions for W365 managed and compliant Devices”.
4. Tick Publish to apps and pick an ID from the list. The lab used c8.
5. Select Save, and note the name and ID, because you need them in Step 3.

Step 2: Create the Conditional Access policy

1. Under Conditional Access, select Policies > New policy and give it a name. The lab used “W365 Device Compliance Policy”.
2. Under Users or agents, include the group of users the policy applies to.
3. Under Target resources, change the drop-down to Authentication context and tick the context from Step 1.
   

   

4. Under Grant, choose Grant access, tick Require device to be marked as compliant, and select Select. The portal shows a “Don’t lock yourself out” warning here; read it, even though this policy targets an authentication context rather than the Cloud PC app itself.
   

   

5. Set Enable policy to On and select Create. The portal defaults to Report-only, and it confirms that the policy will be enabled in a few minutes.
   

   

Step 3: Create the Remote Connection Experience policy in Intune

1. In the Intune admin center, go to Devices > Manage Windows 365 Cloud PCs > Cloud PC Settings, then select Create > Remote Connection Experience.
   

   

2. On Basics, enter a name and description. The lab used “DevRemoteExperience”.
3. On Configuration settings, expand Device redirections. For Drive & storage, Clipboard, Printer and USB redirection, pick the “Authentication context: Context-based redirection” option, then choose the context from Step 1 in the Entra Authentication context list that appears. The lab set all four to c8.
   

   

4. Leave Windows Cloud I/O Protection and Admin default preferences on Not configured (Default) unless you have a reason to change them, and keep the Default scope tag.
5. On Assignments, add the group that contains the target Cloud PCs. Microsoft’s guidance is a device group, not a user group, because context-based redirection is enforced at the device level.
   

   

6. Select Next, review the summary, and select Create. The new policy appears in the Cloud PC Settings list with the type Remote Connection Experience.
   

   

Validating the result

Test from two kinds of device, because the difference between them is the whole point of the feature.

For clipboard, check whether copy and paste works between the local device and the remote session. If the behaviour does not match the table, Microsoft suggests checking:

• The Conditional Access policy assignment and the authentication context it targets.
• The device’s compliance status in Microsoft Entra ID and Intune.
• The assignment of the Remote Connection Experience policy.
• Any existing redirection policies that might override this configuration.

Best practices and things to watch for

• Assign to device groups. The Intune policy must target a device group that contains the Cloud PCs, not a user group, because enforcement happens at the device level.
• Turn the Conditional Access policy on. The portal defaults to Report-only, and Microsoft’s steps set it to On. Allow a few minutes after creating it before you test.
• Check for overriding policies. Review the other policies on the Cloud PC Settings page, which lists a rank for each one, and any other redirection settings that could override this configuration.
• Remember it is a Preview. Scope is limited to Windows 365 Enterprise and Flex dedicated mode, and to full desktop sessions, so validate before relying on it to protect production data.
• Know what it does not cover. It controls four redirections. Display protection and input protection under Windows Cloud I/O Protection are separate settings in the same policy.
• Expect compliance changes to show up. Redirections depend on the connecting device meeting the requirement, so a device that falls out of compliance should be expected to lose them; brief your service desk accordingly.
• Name things clearly. Record the authentication context name and ID, since you reuse the ID in every redirection setting, and Entra will not let you delete a context that a Conditional Access policy references.

Conclusion

Context-based redirection turns clipboard, drive, printer and USB redirection from a fixed setting into a decision made for each connection, using Conditional Access signals you already manage.

The recipe is three steps: create an authentication context, create a Conditional Access policy that targets it, and map the context to each redirection in an Intune Remote Connection Experience policy. Start with a simple rule such as compliant devices only, test from both a compliant device and a BYOD device, and widen the design from there. Since the feature is in Preview, validate it thoroughly before you depend on it.

Sources

• Configure context-based redirections (Preview), Microsoft Learn: article last updated 23 October 2026.
• Lab screenshots from a hands-on build of the configuration described above.