Windows App Migration Plan: Replacing Deprecated Remote Desktop Clients in Commercial Cloud

From March 27, 2026, Microsoft no longer supports two legacy remote access clients in commercial cloud environments:

Remote Desktop client for Windows (MSI) — the separate MSI client for cloud resources, not the built-in MSTSC Remote Desktop Connection
Remote Desktop web client — the cloud Remote Desktop web client; this is not a blanket retirement of on-premises RD Web Access

Microsoft’s direction is Windows App for Azure Virtual Desktop and Windows 365 access. The current platform matrix does not support RDS connections from Windows App on Windows; remote-PC connections on Windows are preview, and MSTSC remains the generally available remote-PC client. Do not remove RDS clients or RD Web bookmarks merely because the cloud MSI/web clients reached end of support. See the precise retirement scope. The March 2026 Windows App update also adds keyboard input protection and reliability fixes.

This guide is an admin cutover plan: inventory who still uses legacy clients, deploy Windows App through Intune, validate session scenarios, and update helpdesk documentation before relying further on an unsupported cloud client.

See the Intune hub, Intune vs SCCM comparison, and Conditional Access policy map for related deployment context.

Who Needs To Act

Team	Responsibility
EUC / desktop engineering	Client packaging, Intune deployment, pilot rings
AVD / Windows 365 platform team	Feed URL validation, session host compatibility
Identity	Conditional Access for remote access apps where used
Service desk	Updated user guidance and escalation paths
Security	Review keyboard input protection and data boundary comms

If you only manage corporate laptops and nobody uses AVD, Windows 365, or RDS through the MSI client, impact may be limited. Still run inventory — shadow IT remote access is common.

Phase 1: Inventory Legacy Client Usage

What to find

Signal	Where
Installed Remote Desktop MSI	Intune discovered apps, ConfigMgr inventory, or software inventory script
RD web client bookmarks	Service desk tickets, browser favourites audits, published RD Web URLs
Windows App already present	Microsoft Store apps report in Intune
Active connection paths	AVD diagnostics, Windows 365 connectivity reports, RDS gateway logs

PowerShell inventory example (local audit script)

PowerShell

$UninstallKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

Get-ItemProperty $UninstallKeys -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'Remote Desktop' } |
    Select-Object DisplayName, DisplayVersion, Publisher, InstallDate

Expected output shape: zero or more Remote Desktop MSI entries with version and install date.

User population segmentation

Build three groups:

AVD users — full desktop or RemoteApp via feed
Windows 365 users — Cloud PC connections
RDS gateway / RD Web users — a separate compatibility review; retain the supported RDS client for their platform

Each group may need different feed URLs, MFA behaviour, and test cases.

Phase 2: Deploy Windows App Through Intune

Preferred distribution paths

Method	When to use
Microsoft Store app (Intune)	Default for most managed Windows 11/10 devices
Official Windows App package, where documented for the target platform	Restricted Store environments; validate the current package and update mechanism
Required app assignment	Standard corporate remote-access users
Available in Company Portal	Optional installs for infrequent users

In Intune:

Apps > Windows > Microsoft Store app (new)
Search for Windows App
Assign as Required to pilot group, then production remote-access groups
Confirm install status in Devices > Monitor > App install status

Coexistence during pilot

Validate Windows App for each affected cloud scenario before removing its old MSI package. Any temporary retention of an unsupported client needs a named owner and expiry; it is not a supported long-term fallback. The local registry sample requires read access and misses per-user installations, so reconcile it with service usage and management inventory.

Phase 3: Pilot Test Matrix

Test every scenario your users actually run — not just "can I connect."

Scenario	Pass criteria
AVD full desktop	Session launches, audio, clipboard, drive redirection as policy allows
AVD RemoteApp	Published app opens and reconnects after sleep
Windows 365 Cloud PC	Cloud PC connects with expected MFA prompt
RDS feed via gateway	Keep a supported platform/client path; Windows App on Windows is not currently the RDS replacement
Reconnect after network change	Session resumes or clean reconnect without data loss
Keyboard input protection	Security team confirms control meets policy (per Microsoft release notes)

Record build versions of Windows App tested and the session host image versions they connected to.

Phase 4: User And Helpdesk Cutover

Helpdesk script update

Replace references to:

"Open Remote Desktop" MSI shortcut
RD Web portal URL as primary path

With:

Windows App from Start menu or pinned taskbar
Your organisation's published feed URL or Windows 365 entry point

Communication template

What is changing: The old Remote Desktop (MSI) app and browser web client are no longer supported for connecting to <AVD / Windows 365>.

What to do: Use Windows App on your managed device. It is installed automatically. Sign in with your work account and open your usual desktop or app.

If connection fails: Contact the service desk and include the time of failure and whether you are on office or home network.

Conditional Access check

Review the actual resource and Conditional Access results in pilot sign-in logs. A client rename is not evidence that a new cloud-app target or exclusion is required. Test sign-in from pilot users before broad removal of legacy client.

Phase 5: Remove Legacy Client

After pilot sign-off:

Create Intune Uninstall assignment for the MSI Remote Desktop package where you previously deployed it
Block legacy client reinstall via App Control or software restriction policy if needed
Update only the deprecated cloud-client links; preserve on-premises RD Web and other supported access paths
Monitor helpdesk volume for two weeks

Rollback

Issue	Response
Windows App fails for one app collection	Use an approved supported access path, such as Windows App web where the service supports it; do not make an unsupported MSI the routine rollback
Store install blocked on network	Deploy via allowed offline package path; fix proxy/Store endpoints
MFA loop on launch	Review CA policy and primary refresh token state before reverting client

Prevention Checks

Add Windows App version to standard desktop build image going forward
Include remote access client in new-starter onboarding checklist
Review Microsoft release notes quarterly for Windows App breaking changes
Keep AVD and Windows 365 feed URLs in a single internally owned configuration document

Source

This operational migration plan is based on the official Windows IT Pro Blog post published by Microsoft on March 30, 2026, extended with enterprise inventory, Intune deployment, and cutover steps for EUC administrators.

Correction record

10 September 2026 — Reviewed against documentation: Corrected cloud client retirement scope, MSTSC and RDS distinctions, removed the offline Store licence assumption, and clarified migration recovery.