By David, , updated
RDP Shortpath moves an Azure Virtual Desktop (AVD) session from the TCP gateway connection onto a direct UDP transport between the user's device and the session host, which gives lower, steadier latency. For users on the internet it works without configuration in Azure as long as UDP isn't blocked, so setting it up is mostly a matter of opening the right outbound UDP paths, while Shortpath for managed networks (ExpressRoute or VPN) needs a UDP listener you enable on each host.
The short version: allow outbound UDP from the session host subnet, including UDP 3478 to the TURN relay range
51.5.0.0/16. Allow the same from client networks. Avoid forced tunneling, double NAT, TCP-based VPNs and cloud packet inspection. Then check the transport in the client's connection information, and across the estate in AVD Insights.
How RDP Shortpath connects
Every AVD connection starts on TCP, through the AVD gateway's reverse connect transport. The client and session host then try to establish UDP in the background. If UDP succeeds, the session moves to it and the TCP connection drops. If not, the session stays on TCP (Microsoft Learn).
| Type | Path | When it's used | What you configure |
|---|---|---|---|
| Public networks, STUN | Direct UDP between client and host, found with STUN | First choice over the internet | Outbound UDP from the host subnet and the client network |
| Public networks, TURN | UDP relayed through a TURN server in Azure | When firewalls or symmetric NAT block a direct path | Outbound UDP 3478 to the relay range |
| Managed networks, direct | Client connects straight to a UDP listener on the host (port 3390 by default) | Over ExpressRoute private peering or a site-to-site VPN | Enable the listener and allow the inbound port on each host |
| Managed networks, ICE/STUN | Direct UDP over the private network, found with STUN | Over a VPN or ExpressRoute, without an inbound port | No inbound rule on the host |
| Fallback | TCP through the gateway | When no UDP path works | Nothing: it's automatic |
When more than one UDP path works, the client uses whichever connects first. Shortpath for public networks via STUN and TURN is generally available in Azure commercial and Azure Government.
Setup checklist: public networks
- Leave the defaults alone. Shortpath for public networks works automatically when networks and firewalls allow the traffic and the RDP transport settings on hosts and clients are at their Windows defaults. If someone set the Group Policy to use TCP only, undo it.
- Allow outbound UDP from the session host subnet. Microsoft's rules for Azure commercial:
| From | To | Port | Protocol | Purpose |
|---|---|---|---|---|
| Session host subnet | Any | 1024-65535 (default 49152-65535) | UDP | STUN direct connection |
| Session host subnet | 51.5.0.0/16 | 3478 | UDP | STUN and TURN relay |
| Client network | Public IPs of your NAT gateway or Azure Firewall | 1024-65535 (default 49152-65535) | UDP | STUN direct connection |
| Client network | 51.5.0.0/16 | 3478 | UDP | STUN and TURN relay |
In Azure Government, the TURN relay range is 20.140.236.0/22 instead. Microsoft has moved the TURN relay off the old shared 20.202.0.0/16 range, so update any firewall rule that still names it.
- Know your NAT. Azure Firewall and Azure NAT Gateway use symmetric NAT, which blocks a direct STUN connection. Sessions then use a TURN relay, which is still UDP. If you want fewer open ports, you can limit the port range clients use.
- Follow Microsoft's network recommendations. Avoid forced tunneling for users connecting over the internet, double NAT and carrier-grade NAT, cloud packet-inspection services and TCP-based VPNs. Ask users to leave UPnP on at home, and enable IPv6 or Teredo where you can.
- Pick the right region. TURN relays exist in most Azure regions, chosen by the client's location. A client far from any relay may fall back to TCP, and Shortpath can't remove distance: deploy hosts near your users.
Setup checklist: managed networks
- Enable the RDP Shortpath listener on each session host and allow inbound UDP on its port (3390 by default) from your client networks. Or skip the inbound port and let ICE/STUN find the direct path over the private network.
- Prefer a UDP-based VPN. Microsoft notes most TCP-based VPNs carry nested UDP but add TCP congestion control on top, which slows RDP.
- Use QoS if you need it. On managed networks, Shortpath supports DSCP marking for RDP and a per-session outbound throttle rate.
Check that sessions are on UDP
- One session: in Windows App, the connection information panel shows whether the session uses UDP.
- The whole estate: AVD Insights reports the transport and round-trip time per connection from the network data each host pool sends to Log Analytics.
If a session you expected on UDP is on TCP, work from the host outward: the host subnet's outbound UDP rules, then NAT and firewall type, then the client's network.
| Symptom | Likely cause | Fix |
|---|---|---|
| Every session on TCP | Outbound UDP blocked from the host subnet, or TCP-only policy | Allow the UDP rules above, reset RDP transport policy |
| Office users on TCP, home users on UDP | Office firewall or proxy blocks UDP | Allow UDP 3478 to the relay range from the office |
| Sessions on TURN, never direct | Symmetric NAT (Azure Firewall or NAT Gateway) | Expected, still UDP; add managed-network Shortpath if you have private connectivity |
| Brief disconnects a few times a month | TURN relay maintenance | Microsoft says the client reconnects within seconds |
| High latency even on UDP | Distance to the region | Move hosts closer to users |
RDP Shortpath for public networks needs no switch turned on. It needs outbound UDP allowed, and a way to see which sessions fell back to TCP.
Where Atlas AVD helps
Atlas AVD doesn't change your RDP Shortpath configuration. It shows you whether it's working:
- Network Transport. With AVD Insights connected, the Network Transport card on the Analytics Experience tab shows UDP adoption across your sessions, adoption by host pool, and recent sessions that fell back to TCP.
- Connection Quality. The Connection Quality dashboard widget breaks round-trip time into good, fair and poor.
- Per user. The Users page shows each session's last latency, and opening a user shows their latency graph and connection history.
- Diagnostics in your workspace. For the pools it deploys, Atlas turns on AVD Insights diagnostics into your own Log Analytics workspace.
That's the real Atlas AVD console in our demo environment; the pools and scores are sample data. Shortpath matters most for calls and video: see Teams on AVD and Zoom on AVD.
FAQ
Is RDP Shortpath enabled by default in Azure Virtual Desktop?
RDP Shortpath for public networks works automatically, without extra configuration, when networks and firewalls allow UDP and the RDP transport settings are at their defaults. Shortpath for managed networks needs a UDP listener you enable on the hosts.
What ports does RDP Shortpath use?
For public networks, UDP 3478 to the TURN relay range (51.5.0.0/16 in Azure commercial) and dynamically assigned UDP ports, 49152 to 65535 by default. For managed networks, the host's UDP listener, 3390 by default.
What's the difference between STUN and TURN in RDP Shortpath?
STUN helps the client and host find each other's public addresses for a direct UDP connection. TURN relays the UDP traffic through a server in Azure when a direct connection is blocked.
How do I know if a session is using RDP Shortpath?
In Windows App, the connection information shows whether the session uses UDP. AVD Insights shows the transport for every connection.
Does RDP Shortpath work with Azure Firewall?
Yes, but Azure Firewall and NAT Gateway use symmetric NAT, so sessions usually use a TURN relay rather than a direct STUN connection.
Is RDP Shortpath less secure than TCP?
No. Microsoft says it uses TLS over reliable UDP and offers the same security as the TCP reverse connect transport, and it's set up only after the connection is brokered and authenticated.
Last updated 9 November 2026. Microsoft details are drawn from Microsoft Learn's RDP Shortpath as of November 2026, including the TURN relay ranges for Azure commercial and Azure Government. Check the page before you change firewall rules: Microsoft updates the relay ranges and regions.