How to extend rules for software installation and web browsing

Andriy Vlasenko (International Supplier) 40 Reputation points Microsoft External Staff
2026-06-02T13:31:54.1866667+00:00

Dear support team,

I work on AVD, but I have no rights visiting even official sites of my clients, but I cannot open it. Access is blocked. The same for any official site of any company. I also cannot install Azure VPN. The local group policy editor says I have zero rights. What should I do in this case?

Kind regards,

Andrey

Azure Virtual Desktop
Azure Virtual Desktop

A Microsoft desktop and app virtualization service that runs on Azure. Previously known as Windows Virtual Desktop.

0 comments
Answer accepted by question author
Manish Deshpande 8,215 Reputation points Microsoft External Staff Moderator
2026-06-20T18:51:17.4066667+00:00

Hello @Andriy Vlasenko (International Supplier)

Thanks for reaching out, and I understand how blocking this is when you can't even open your clients' sites or install the VPN you need to work. The reassuring part: you haven't done anything wrong, and nothing is broken on your side.

On Azure Virtual Desktop, both web access and software installation are controlled centrally by your organization's IT policies. These can't be changed from inside the session which is exactly why the Local Group Policy Editor shows you have no rights: your account is a standard user, and editing local policy requires local Administrator membership (this is by design on AVD).

So this isn't something you can self-fix from the session but here's how to get unblocked quickly.

What's blocking you

  1. Websites – When every external site is blocked, it's a deliberate "deny-all outbound except approved" baseline, enforced by Azure Firewall (application rules / web categories), a proxy / secure web gateway, an NSG, or a GPO proxy setting. Your admins can add the specific sites you need to the allow-list.
  2. Azure VPN client install – This is blocked by application control (App Control for Business / AppLocker) and/or the lack of local admin rights. An admin can allow the app or deliver it for you via Intune.

Your fastest path: send your IT/AVD admin this request

"On our AVD host pool, please:1. Allow outbound access to these sites: [list the exact client URLs/domains].2. Allow installation of the Azure VPN client (business reason: [your reason]), or deploy it via Intune.I'm a standard user and can't change these from the session. Screenshots of the block messages are attached."

Links:
https://learn.microsoft.com/en-us/azure/firewall/protect-azure-virtual-desktop
https://learn.microsoft.com/en-us/azure/firewall/web-categories

https://learn.microsoft.com/en-us/azure/virtual-desktop/security-recommendations

https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/appcontrol

Thanks,
Manish.

Was this answer helpful?

2 people found this answer helpful.
0 comments
Answer accepted by question author

AI answer

2026-06-02T13:32:15.04+00:00

The restrictions on visiting websites and installing software in Azure Virtual Desktop are enforced by your organization’s policies. These are not issues that can be fixed locally on the AVD session because:

  • Web access is typically controlled by Group Policy, proxy settings, or secure internet access profiles set by your IT/security team.
  • Software installation (including Azure VPN) is blocked by Software Restriction Policies, AppLocker, or lack of local administrator rights, all of which are centrally managed.

The only effective next step is to involve the administrators who manage the AVD environment and your account. Provide them with:

  1. The exact sites that must be accessible (for example, your clients’ official portals).
  2. The exact software that must be installed (for example, Azure VPN client) and why it is required for work.
  3. Screenshots or text of any “blocked” or “not compliant” messages.

Administrators can then:

  • Adjust web access controls
    • If they use a URL lock/proxy or secure internet access baseline, they must add your required sites to the allowed list or exceptions. For example, a restrictive “deny all outbound except selected services” configuration must be extended to include your clients’ official sites so they are reachable from AVD.
    • If they use Group Policy–based proxy restrictions, they can modify the proxy/exception list in the GPO so that the required domains are reachable from your AVD sessions.
  • Adjust software execution/installation controls
    • If Software Restriction Policies are blocking installers or applications, they must create rules that allow the Azure VPN installer and client to run. SRP is designed to “allow only identified applications to run,” so only an administrator can change those rules.
    • If AppLocker rules or other application control are in place, they must add allow rules for the Azure VPN client.
    • If the problem is missing local administrator rights, they must either perform the installation for you or temporarily use an account with full administrator rights to install the VPN software.
  • Confirm device/account compliance
    • If conditional access or compliance policies are in use, they may require that the AVD session or your device meet certain conditions before accessing external resources. Only the admin can review and adjust those policies.

Because the Local Group Policy Editor shows no rights, there is no supported way to bypass or override these restrictions from within the AVD session. The required changes are all on the admin side (Group Policy, Intune/Endpoint Manager, network security, or Entra/conditional access).

Provide this explanation to the IT or AVD admin team and request that they:

  • Whitelist the necessary client and vendor sites in their web filtering/proxy or secure internet access configuration.
  • Allow installation and execution of the Azure VPN client via SRP/AppLocker or install it for you using an admin account.
  • Verify that any compliance or conditional access policies are not unnecessarily blocking your work scenario.

References:

AI-generated content may be incorrect. Read our transparency notes for more information.

Was this answer helpful?

2 people found this answer helpful.

0 additional answers

Sort by: Newest
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.