Possible for RDWeb with Entra App Proxy to use .RDP file instead of RDWeb client

Question

Possible for RDWeb with Entra App Proxy to use .RDP file instead of RDWeb client

Thim 65

I have recently build an RDWeb, published it to the Entra App Proxy and used the RDWeb client method. Everything was working fine but noticed that there are some limitations such as the multi-monitor functions.

Some said that the app proxy works on the rdweb client method and if i download and run the .rdp file, the below error would appear. I am not sure if the .rdp methods are supported but there are basically, no clear steps to configure this. Would appreciate if there is a clear steps on how to configure this or someone who is well versed on this.

Error when running using the .rdp file

Also, I will be implementing this on China via the 21Vianet, so I am not sure this can be implemented in China. Anyone has any experience on this? I heard some might have issues on China sites. Thanks.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Domic Vo 29,960 Independent Advisor

Hi Thim,

This Windows-related issue occurs because the native RDP client cannot process the web-based authentication cookie required by Entra Application Proxy pre-authentication, resulting in error 0x300002f. To fix this and maintain multi-monitor support, you must separate your published applications. Keep Entra ID Pre-Authentication enabled for the RDWeb portal, but publish the RD Gateway as a separate enterprise application with its pre-authentication set to Passthrough. This allows the downloaded .rdp file to bypass the web prompt and authenticate natively.

For your 21Vianet deployment in China, this exact architecture is fully supported. However, be prepared for high latency and packet loss across the national firewall, which will inevitably degrade the remote multi-monitor experience regardless of your configuration.

Domic V.

Thim 65 Reputation points

2026-06-08T08:19:04.1666667+00:00

Hi Domic,

Do you have any reference for this? Some of the reference that I read said that they can do a lot of stuff with the downloaded .rdp files. Copilot suggest a hybrid where I need to publish the gateway url and inject the url to the .rdp file but this defeat the purpose of the user experience and security.

Answer 2

Using Microsoft Entra application proxy with Remote Desktop Services supports two main access paths from the context:

RD Web with the classic ActiveX-based experience (Internet Explorer mode in Edge) and Web SSO.
The Remote Desktop web client (HTML5) over application proxy.

For Entra preauthentication, the supported scenario is that users launch RemoteApps/desktops from RD Web or the RD Web client. The context explicitly notes that using downloaded .rdp files with this preauthentication flow is not supported:

“This option enables the user to download the rdp file and use it by another RDP client (outside of the Remote Desktop Web Client). Typically, another RDP clients (like the Microsoft Remote Desktop Client) can't handle the preauthentication natively. That's why the scenario doesn't work.”

In other words:

When RD Web is published through Microsoft Entra application proxy with Entra preauthentication, .rdp files downloaded from RD Web and opened directly in mstsc or another RDP client are not a supported access method.
The error seen when launching the .rdp file is expected behavior in this configuration, because the RDP client cannot perform the required Entra preauthentication and use the application proxy cookie.

The supported configuration for this scenario is:

RD Web and RD Gateway on the same server and published as a single application through Microsoft Entra application proxy.
Users connect via a supported browser to RD Web or the RD Web client and launch resources from there.
For Web SSO with the built-in Remote Desktop Connection client, the supported path is to connect to RD Web via Internet Explorer Mode in Microsoft Edge with the documented server-side settings (RD Web forms auth, RD Gateway password auth, and “Use RD Gateway credentials for remote computers”).

There is no supported configuration in the provided context that enables generic .rdp files (outside RD Web / RD Web client) to work through Microsoft Entra application proxy preauthentication.

Regarding China/21Vianet, the context provided does not contain any specific guidance or support statement, so no additional details can be given from this source.

References: