Air Force Virtual Desktop (EITaaS VDI)

What EITaaS VDI is

EITaaS VDI (Enterprise IT as a Service, Virtual Desktop Infrastructure) is the Air Force's current remote-desktop service: a cloud-hosted AFNET Windows desktop you stream to your own computer. Inside it you get the things a personal machine can't reach anymore — NIPR-only websites, your webmail client with working S/MIME, Adobe Acrobat for signing, and the rest of a standard AFNET workstation.

It replaces the tools you may remember: Desktop Anywhere (VMware Horizon) is gone, and the interim Azure Virtual Desktop (AVD, sometimes called SonicBoom) has been folded into EITaaS. If your old AVD desktop vanished one day, this page is why.

Do you need to register?

• You used AVD/SonicBoom before: you were most likely migrated automatically — try connecting first.
• You only ever used VMware Horizon / Desktop Anywhere: you need to register.
• Never used any of them: you need to register.

Registering for access

1. Open the EITaaS Service Center Go to eitaas.servicecenter.af.mil from any computer with your CAC ready — you do not need to be on AFNET. If the site won't load from home, see the fix below.
2. Find the request form Search the catalog for "Request Virtual Desktop Service." Make sure you're on the request form, not the VDI support form.
3. Fill it out It takes about a minute: your name, phone number, your base as the location (Gunter Annex personnel select Gunter), request type add user to service, and the Standard User Persona desktop. Building, room, and hostname can stay blank, and a one-line justification ("I work away from base access") is enough.
4. Submit and wait Use the Order Now button and expect provisioning within roughly 1–3 business days. For urgent needs, a polite call to your EITaaS service desk sometimes helps.

Connecting with the Windows App

EITaaS VDI is accessed through Microsoft's Windows App (the successor to the Remote Desktop clients) on Windows and macOS.

1. Install the Windows App From the Microsoft Store / App Store, or on the command line:

   # Windows
   winget install --id Microsoft.WindowsApp -e
   
   # macOS
   brew install --cask windows-app

2. Sign in or add the workspace On Windows: sign in with a work-or-school account using your us.af.mil email — this won't disturb the Microsoft account already on your PC. On macOS: click + → Connect to workspace and enter the Azure Government feed URL:

   https://rdweb.wvd.azure.us/api/arm/feeddiscovery/

3. Authenticate with your CAC When the certificate picker appears, choose your CAC authentication certificate (see which is which) and enter your PIN.
4. Launch your desktop If your EITaaS desktop tile appears, double-click it and you're on a NIPR machine. If nothing appears, you likely still need to register.

Troubleshooting

The Service Center won't load from home

A login page that flashes and dies, endless spinners, or DNS errors almost always mean a certificate-trust problem on your machine. Work through:

• Install the current DoD certificates — from the DoD Cyber Exchange only, never a third-party mirror. This fixes most cases.
• Try a private/incognito window, or clear cookies and cache for the site.
• Try a different network (phone hotspot counts). Some residential IPs and geolocations get filtered; if you use a VPN, try toggling it — and never use a free VPN for military sites.

Smart card not recognized inside the VDI

• The remote desktop reaches your CAC through USB passthrough, which is pickier than local use. Community experience: some cheap readers authenticate locally but fail in VDI — Identiv-brand readers have the best track record, and some IOGear models are known problem children. See CAC readers.
• Plug the reader directly into the computer, not a hub or dock.
• Insert the card before launching the Windows App.

Sign-in loops on macOS

Stale cached credentials can wedge the Microsoft sign-in flow. Open Keychain Access, search for "Microsoft," sort by date, and delete the recent entries related to the Windows App sign-in, then try again.

A desktop you had has disappeared

Platform migrations have silently dropped users before. If signing out/in and reinstalling the Windows App doesn't bring it back, submit the request form again — re-adding yourself to the service is the documented path back in.

Phones and tablets

The Windows App also runs on iOS and Android, but your CAC has to reach it somehow. The practical route is a FIPS 140-validated YubiKey 5C NFC provisioned with your CAC-derived certificate — provisioning requires support from your unit or EITaaS, and the key itself (~$100) isn't free, so this is a "your unit buys in" solution rather than a casual one. Plugged into the phone's USB-C port, it authenticates the Windows App; NFC-only and Android passthrough setups are hit-or-miss. Standard USB-C CAC readers with smart-card utility apps may work but are not a sure thing — see Phones & Tablets for the general mobile picture.

Why this beats fighting webmail

With services restricting direct webmail and Teams access from personal machines, a sanctioned virtual desktop is the clean answer: your personal computer only ever streams pixels, the work happens on an approved AFNET machine, and things that are painful locally — S/MIME email, NIPR-only portals, CUI handling — just work where they're supposed to. Keep your personal machine patched and current all the same.