Hi Matthew. This is a common query with ZPA deployments, especially when the users are permanently outside the corporate network.
There’s a number of elegant solutions to cater for your RDP requirement. If you’re using InTune to manage your desktop fleet, there’s a great plugin for TeamViewer that ties in InTune. More info on that here:
Of course, you could use Teamviewer on its own, but this plugin ties in nicely with InTune.
If your using Workspace ONE, they have a feature called Assist which again provides that nice MDM integration. More on that here: https://www.air-watch.com/capabilities/workspaceone-assist/
I have not evaluated all options out there, There’s bounds to be numerous others.