Configure the clipboard transfer direction and data types that can be copied in Azure Virtual Desktop

Clipboard redirection in Azure Virtual Desktop allows users to copy and paste content, such as text, images, and files between the user's device and the remote session in either direction. You might want to limit the direction of the clipboard for users, to help prevent data exfiltration or malicious files being copied to a session host. You can configure whether users can use the clipboard from session host to client, or client to session host, and the types of data that can be copied, from the following options:

  • Disable clipboard transfers from session host to client, client to session host, or both.
  • Allow plain text only.
  • Allow plain text and images only.
  • Allow plain text, images, and Rich Text Format only.
  • Allow plain text, images, Rich Text Format, and HTML only.

You apply settings to your session hosts. It doesn't depend on a specific Remote Desktop client or its version. This article shows you how to configure the direction the clipboard and the types of data that can be copied using Group Policy.

Prerequisites

To configure the clipboard transfer direction, you need:

Configure clipboard transfer direction

Here's how to configure the clipboard transfer direction and the types of data that can be copied. Select the relevant tab for your scenario.

To configure the clipboard using Group Policy in an Active Directory domain, follow these steps.

Important

These policy settings appear in both Computer Configuration and User Configuration. If both policy settings are configured, the stricter restriction is used.

  1. The Group Policy settings are only available in Windows 11, version 23H2 and later. You need to copy the administrative template files C:\Windows\PolicyDefinitions\terminalserver.admx and C:\Windows\PolicyDefinitions\en-US\terminalserver.adml from a session host to the same location on your domain controllers or the Group Policy Central Store, depending on your environment. In the file path for terminalserver.adml replace en-US with the appropriate language code if you're using a different language.

  2. On a device you use to manage Group Policy, open the Group Policy Management Console (GPMC) and create or edit a policy that targets your session hosts.

  3. Browse to one of the following policy sections. Use the policy section in Computer Configuration to the session host you target, and use the policy section in User Configuration applies to specific users you target.

    • Machine: Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection

    • User: User Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection

    A screenshot showing the device and resource redirection options in the Group Policy editor.

  4. Open one of the following policy settings, depending on whether you want to configure the clipboard from session host (server) to client, or client to session host:

    • To configure the clipboard from session host to client, open the policy setting Restrict clipboard transfer from server to client, then select Enabled. Choose from the following options:

      • Disable clipboard transfers from server to client.
      • Allow plain text.
      • Allow plain text and images.
      • Allow plain text, images, and Rich Text Format.
      • Allow plain text, images, Rich Text Format, and HTML.
    • To configure the clipboard from client to session host, open the policy setting Restrict clipboard transfer from client to server, then select Enabled . Choose from the following options:

      • Disable clipboard transfers from client to server.
      • Allow plain text.
      • Allow plain text and images.
      • Allow plain text, images, and Rich Text Format.
      • Allow plain text, images, Rich Text Format, and HTML.
  5. Select OK to save your changes.

  6. Once you've configured settings, ensure the policy is applied to your session hosts, then refresh Group Policy on the session hosts and restart them for the settings to take effect

  7. Connect to a remote session with a supported client and test the clipboard settings you configured are working by trying to copy and paste different types of content.