Thank you for your detailed post! To ensure I fully understand your issue, I'll share a summary below.
Error Message:
Configuration:
Remote Desktop Solution is installed on your Azure AD Connect server to publish your on-prem application in RemoteApp - your Broker, Gateway, RDWeb, and Licensing are on this server as well.
- Permissions to access the RDWeb URL are correctly set
- In Azure proxy : Configure internal URL for the application (this is the URL of the RDweb page, example : https://hostnameofserver.mycustomdomain.com/rdweb/).
- In Azure proxy : The external URL using a custom domain with certificate (example : https://myapplicationame.mycustomdomain.com/rdweb/).
- In Azure proxy : Pre-authentication with Azure Active Directory.
- The communication from server to/from Application Proxy are Open (443 and 80).
- The policies with the RD Gateway Manager are also configured (Connection authorization policies and Ressource Authorization Policies).
- Configure CNAME in DNS to redirect to msappproxy domain. I have configured the RD Gateway server settings with the take over with this URL : myapplicationame-mycustomdomain.msappproxy.net and tried also with custom domain : myapplication.mycustomdomain.be
- Settings for the downloaded RDP file with this Powershell command: Set-RDSessionCollectionConfiguration -CollectionName "XXX" -CustomRdpProperty "pre-authentication server address:s:https://myapplicationame-mycustomdomain.msappproxy.net/`nrequire pre-authentication:i:1"
Issue:
After installing and configuring the Azure Application Proxy to publish your application, you ran into the error message above. You've ensured the settings populated within the RDP file are correct and when trying with HTML5, you didn't run into this issue since the RDP file isn't launched which doesn't redirect to the Gateway server. The issue seems to only be occurring when downloading the RDP file and executing / launching the file.
Troubleshooting:
To hopefully help point you in the right direction since your error message is related to a firewall credential issue:
- I noticed that you opened port 443 and 80 for Internet traffic - did you also Allow access to these URLs?
- Can you ensure that TLS 1.2 is enabled?
- Do you have the RDS ActiveX add-on installed and enabled if using Internet Explorer or Edge IE Mode?
- When you published your RD host endpoint, can you make sure these settings are correct within your configuration(s)?
- When you checked your RDP file properties, do you have -
pre-authentication server address:s:https://External_Url/
andrequire pre-authentication:i:1
on separate lines? - Have you tried collecting a network trace to see if there's more info on your issue?
Note: Please keep in mind PII.
Since troubleshooting RDS with the Azure AD App proxy requires deeper troubleshooting, if you'd like to work with our support team through a one-time free technical support request, please let me know.
Additional Links:
- Publish Remote Desktop with Azure Active Directory Application Proxy
- Troubleshoot Application Proxy problems and error messages
- RDS deployment - RDP fails (authentication to the firewall failed due to) - Similar issue
- General Remote Desktop connection troubleshooting
- RDWeb with MFA: Unable to Open Application on Non-IE Browsers - 3rd party solution
I hope this helps!
If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.