Dear Saeydul Amin
Sure , we are happy to help you
To set this up, you’ll want to start by creating a Windows 11 Enterprise multi‑session VM in Azure. When you deploy it, make sure you enable Entra ID join so the VM is directly tied into your identity platform. From there, you can configure automatic enrollment into Intune by setting the MDM enrollment option in Entra ID, this way the VM will be managed right out of the box. For access control, create a security group in Entra ID that contains only the users you want to allow, then assign that group to the VM using role‑based access control (RBAC).
To prevent those users from doing admin operations, don’t give them elevated roles just assign them the “Virtual Machine User Login” role instead of “Virtual Machine Administrator Login.” That way they can sign in and use the session but won’t have permissions to mess with system settings. Intune policies can also help you lock down the environment further, like restricting local admin rights or applying compliance rules.