What you’re seeing
- Users approve the MFA prompt, then are asked to sign in and approve again, over and over.
- The Windows App or Remote Desktop client never gets past authentication to show the desktop or published apps.
- Some users or devices loop endlessly while others connect normally.
- Sign-in logs show successful MFA followed by interrupted or failed sign-ins for the same session.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- Conditional Access policies apply to both the Azure Virtual Desktop service and the sign-in to the session host, and their requirements conflict.
- A sign-in frequency of "every time" applies to a resource the client calls repeatedly while connecting, so each step demands fresh MFA.
- Single sign-on to the session hosts is enabled, but a policy on that sign-in requires something the session can't satisfy, such as a compliant device.
- Legacy per-user MFA is still turned on alongside Conditional Access, producing duplicate prompts.
- Cached tokens on the user's device are corrupt or belong to a different account, so authentication never completes cleanly.
Why it matters
Azure Virtual Desktop is often the only way remote staff reach line-of-business apps, files and printers. An MFA loop locks them out completely while making it look like they're doing something wrong, which drives frustration and repeated help desk calls. Under pressure, someone may be tempted to switch MFA off to get people working, which exposes the environment to account takeover. The right fix keeps strong authentication in place while making the policies work together.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Should we just turn off MFA for Azure Virtual Desktop?
No. Removing MFA from a remote desktop service is one of the most common ways attackers get in. The loop is a policy conflict that can be resolved while keeping MFA enforced.
Why do only some users get stuck?
Policies often target specific groups, devices or locations, so users who fall into overlapping policies hit the conflict while others don't. That pattern is a useful clue for the engineer.