Securing Cloud Pcs And Azure Virtual Desktop Official

“They’re not breaking the glass,” Marta explained to the CISO the next morning. “They’re walking through the front door wearing our uniform.”

The Ghost in the Gold Image

Frustrated, the attacker pivoted. They tried to deploy a new session host directly via the Azure API. But Marta had locked down the with Azure Privileged Identity Management (PIM) . You couldn’t spin up a host without a time-bound, approved, audited elevation request. securing cloud pcs and azure virtual desktop

At 2:17 AM, the alert fired again. A new ghost session. But this time, the Conditional Access policy rejected it. “They’re not breaking the glass,” Marta explained to

This was the nuclear option. She rebuilt the Azure Compute Gallery. Instead of persistent Cloud PCs that lived for months, she deployed multi-session AVD pools with Ephemeral OS disks . Every time a user signed out, their entire Cloud PC was destroyed and rebuilt from a fresh, immutable gold image. But Marta had locked down the with Azure

In the morning, Marta walked to the CISO’s office. She placed a single piece of paper on his desk. It was a printout of the failed login attempts.

Marta watched the logs live. The attacker had tried the same trick—a stolen token—but now, without a compliant, Intune-registered device, the session was stonewalled.