MC807445 – Plan for Change: Inbound Access to Port 3389 Closed by Default for Windows 365 Cloud PCs (archived)

Product:

Entra, Intune, Microsoft 365 Apps, Windows 365

Platform:

Windows Desktop, World tenant

Status:

Change type:

Admin impact

Links:

Details:

Summary:
Starting July 2024, Windows 365 Cloud PCs will have port 3389 closed by default to enhance security. Organizations are advised to keep it closed but can manage access via Windows 365 Security Baselines or Intune custom Firewall rules if necessary. Reprovisioning will close open port 3389 on existing Cloud PCs.

Details:
In line with Microsoft's Secure Future Initiative, we are enhancing the security of Windows 365 Cloud PCs. Starting in July 2024, all newly provisioned Cloud PCs will have Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) port 3389 closed by default via Windows Firewall. This change aims to provide better protection against potential cyber threats, such as man-in-the-middle attacks and ransomware, ensuring a more secure computing environment for our users. Therefore, Microsoft strongly advises keeping port 3389 closed to maintain these heightened security standards.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:

Created:
2024-07-02

updated:
2024-07-02

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

Direct effects for Operations**

- Direct Impact on IT Operations
- Increased complexity in managing firewall settings for Windows 365 Cloud PCs
- Roles impacted: IT Administrators, Security Teams
- Dependencies: Existing firewall configurations, network security policies
- Potential downtime during reprovisioning of Cloud PCs
- Roles impacted: IT Support Staff, End Users
- Dependencies: User data backup processes, reprovisioning schedules
- Need for enhanced monitoring and auditing of access requests to port 3389
- Roles impacted: IT Security Analysts, Compliance Officers
- Dependencies: Security information and event management (SIEM) systems, logging mechanisms

- Direct Impact on IT Services
- Altered access methods for remote desktop connections, requiring updates to user training and documentation
- Roles impacted: Training Coordinators, IT Support Staff
- Dependencies: User training materials, helpdesk support processes
- Increased reliance on Intune for managing custom firewall rules
- Roles impacted: IT Administrators, System Engineers
- Dependencies: Intune management infrastructure, existing security baselines
- Potential for increased service requests related to access issues or configuration changes
- Roles impacted: Helpdesk Staff, IT Support Teams
- Dependencies: Ticketing systems, user support workflows

- Direct Impact on IT Users
- Changes in remote access procedures may lead to confusion or disruptions in workflow
- Roles impacted: End Users, Remote Workers
- Dependencies: User access protocols, remote work policies
- Risk of data loss during reprovisioning if users are not adequately informed
- Roles impacted: End Users, Data Management Teams
- Dependencies: Data backup solutions, user communication channels
- Need for users to adapt to new security measures and potential delays in accessing Cloud PCs
- Roles impacted: End Users, Project Managers
- Dependencies: Project timelines, user productivity metrics

References:
- Microsoft Security Blog: [Security Above All Else](https://www.microsoft.com/security/blog/2024/05/03/security-above-all-else-expanding-microsofts-secure-future-initiative/)
- Microsoft Documentation on [Windows 365 Security Baselines](https://learn.microsoft.com/windows-365/enterprise/deploy-security-baselines)
- Microsoft Documentation on [Reprovisioning Cloud PCs](https://learn.microsoft.com/windows-365/enterprise/reprovision-cloud-pc)

Opportunities**

XXXXXXX ... free basic plan only

Potentional Risks**

XXXXXXX ... paid membership only