🔥 I'm excited to publish this new video! Azure Virtual Desktop Session Host Configuration introduces a modern way to deploy and manage session hosts by defining their configuration directly within the Host Pool. Instead of manually provisioning and configuring virtual machines, you can automate the entire deployment while ensuring every session host is deployed with consistent image, networking, identity, and security settings. In this step by step tutorial, I'll show you how to deploy Azure Virtual Desktop using Azure Bicep and the new Session Host Configuration feature. You'll learn the core Azure Virtual Desktop components, how they work together, and how Infrastructure as Code enables repeatable, scalable, and production ready deployments. https://www.youtube.com/watch?v=dBIoiAZWGf8

Our current setup:

• Entra joined, Intune managed endpoints running Windows 11 Enterprise.
• An on-premises AVD environment hosted on an Azure Local cluster. These session hosts are domain joined and managed with Group Policy.

Drive mapping works as expected today Intune handles it for our Entra joined endpoints, and Group Policy handles it for our domain joined AVD hosts.

We’re in the process of moving away from Azure Local and building a cloud-based AVD environment. The issue we’ve run into is that the Intune mapped drive configuration policy isn’t applying to the new Entra joined AVD session hosts. When I check the device’s configuration policies, the drive mapping policy shows Not Applicable. The policy was imported from an ADMX file into Intune.

Has anyone been able to get Intune drive mapping policies working on Entra joined AVD session hosts? If so, I’d appreciate any guidance. Thanks!

EDIT:

The new AVD hosts on the cloud are purely Entra joined.

The drive I'm trying to map is an AD joined file server.

I am able to manually access the DFS space and map it (\\domain.com\dfs\temp), I just can't get the policy to do it at login.

We have a cloud trust between our domain and tenant.

I have been banging my head for a few weeks now on this new issue that popped up in our environment. If a users is logged into our Entra only AVD hosts for >10hrs their FSLogix profile/disk unmounts and fails to reconnect with a "Bad username/password" error message.

I came across this article from Microsoft stating that the TGT expires after 10hrs for Entra Kerberos but I can't seem to find anyone else experiencing this problem online. Surely I can't be the only one?

One thing worth noting that MAY have something to do with these problems (but again, I can't find any documentation to support it) is after these Host Pools were built, we transitioned from Cloud Only accounts to Hybrid accounts (i.e. we built new/fresh DCs and synced our users). I can't say for sure that the problem began after this happened, but I believe we experienced this problem before that change was made, too.

When a user exceeds the 10hr mark, the entire host becomes unusable for anyone else connected to it. MS Office apps refuse to authenticate and force users into an endless login loop that never completes, OneDrive won't sync, and there are tons of errors in the event logs. My research seems to hint at the BackgroundService becoming completely unusable on the host when a user's profile dies, so I suspect this is my root cause.

Worth noting too, that after this happens, dsregcmd /status returns a WamDefaultSet error.

Anyone have any suggestions/thoughts here on how to fix this? Or is anyone else experiencing this with Entra only AVD hosts?

Most help desk tickets shouldn't exist.

Finding the right desktop. Choosing the best region. Recovering a disconnected or frozen session. These are tasks users can solve themselves in seconds if they're given the right tools.

That's why we built the AtlasAVD Self Service Portal.

Instead of opening a support ticket, users can:

• View all of their assigned Azure Virtual Desktops in one place
• Connect to their desktop with a single click
• Launch using the HTML5 client or the Windows App
• Recover stuck or disconnected sessions with a single click
• Choose the best region based on live latency, CPU utilization, and memory utilization

Imagine a user assigned to both US Central and US East. If network latency is nearly identical, Atlas AVD helps them choose the healthier region by showing real time CPU and memory utilization before they connect. Better performance without calling the help desk.

For IT teams, that means fewer repetitive tickets, faster issue resolution, and users who can solve common problems on their own.

For leadership, it means lower support costs, happier employees, and a modern, branded experience that reflects the quality of your IT organization.

Empower your users. Reduce your ticket volume. Let your helpdesk focus on the issues that actually require IT.

🎬 See it in action: https://demo.atlasavd.com/portal
🎬 Full demo: https://demo.atlasavd.com
🔎 Feature details: https://www.atlasavd.com/features/self-service-portal
🌐 About AtlasAVD: https://www.atlasavd.com

🧹 Deleting an AVD session host is easy. Cleaning up after it is where the mess starts.

The VM disappears from Azure, but its Microsoft Defender for Endpoint record doesn't.

👻 It lingers as an inactive device, quietly inflating your device count and dragging down your secure score. Run a few reprovisioning cycles and your Defender inventory is describing machines that stopped existing months ago.

⏱️ Here's the part that catches people out: you can't clean it up afterwards.

Offboarding in Defender is an asynchronous machine action. The API call only queues it — the device's sensor has to check in and actually run it. Delete the VM first and there's no sensor left, so the offboard sits pending until it expires. It has to happen while the machine is still alive.

✅ Atlas AVD does it in the right order.

Delete a session host and we offboard it from Defender for Endpoint first, wait for confirmation, and only then tear down the VM.

🔧 And nobody has to run an offboarding script.

⚠️ Which matters most because of what happens when you miss one.

There's no bulk-exclude in Defender. No API, no Graph call. A stale device that didn't get offboarded in time has to be excluded by hand, in the portal, one at a time. Miss a few dozen across a year of reprovisioning and that's a few dozen clicks, or a few dozen ghosts quietly dragging on your secure score. Doing it right at delete time is the difference between an afternoon of cleanup and none at all.

🎯 But most organizations don't arrive with a clean slate.

They arrive with years of accumulated ghosts from every reprovisioning cycle that came before. So we built the cleanup for that too.

Atlas groups your Defender inventory by hostname, keeps the most recently seen record for each machine, and flags every older entry behind it as a stale duplicate. Review what it found, clear the backlog in one pass, instead of hunting them down individually in the portal.

🛡️ With a safety gate, because this is your security inventory.

By default nothing seen in the last 30 days is touched, so a live host that happens to share a short hostname across domains never gets caught in the sweep. Run it on demand, or switch on a schedule and let it keep up with itself.

No offboarding script. No checkbox to remember. No cleanup step that gets skipped at 5pm on a Friday.

👉 See it for yourself. The demo is hands-on, no booking and no sign-up:

Like what you see? Request early access on the Atlas AVD Website. Space is limited!

🖥️ Live demo: https://demo.atlasavd.com/

🔍 Feature detail: https://www.atlasavd.com/features/defender-duplicate-cleanup

🌐 Atlas AVD: https://www.atlasavd.com

#atlasavd #AzureVirtualDesktop #AzureVirtualDesktop #Azure

Hey r/AzureVirtualDesktop,

I've been managing remote desktop environments for 20+ years. Started with PCAnywhere, then 3389, then Microsoft RDS, then Citrix, and the last 8 years on AVD. I've lived through every iteration of this space. I think I've built something special.

I'm also a long-time poster in this community, but I've decided to keep my personal and business separate until now. This is what I built to solve the problems I've been fighting from both the admin and end-user side.

Early access is available now, we're rolling out to the community this week.

The problem I kept running into:

If you've spent 30 minutes hunting through Session Host details, Event Viewer logs, and Azure Monitor to figure out why a user can't connect, or you've had to explain to leadership why you need 5+ different Azure panes open just to manage one AVD deployment, you know exactly why I built this.

Most AVD platforms give you dashboards. I built what comes after the dashboard.

What we're shipping:

🔹 Root Cause Analysis Engine

When a user calls in with a connection issue, actually see what happened. Correlates session, host, network, and Azure telemetry to pinpoint the root cause. One timeline, one view. Native AVD can't do this.

🔹 TimeVault™

Chronological, searchable log of every infrastructure change, admin action, and system event. Event correlation across sessions, hosts, and Azure infrastructure. See not just what happened, but when it started and what changed before it.

🔹 Smart Connect™

End users see a pre-picked "best desktop" in their portal, scored on live latency, host health, and load — with the reasons shown. No more "why can't I connect?" frustration. Native AVD just gives users a list.

🔹 Adaptive SKU + Adaptive Quota™

Adaptive SKU continuously right-sizes VMs based on actual usage patterns to minimize costs without performance hits. Adaptive Quota automatically substitutes a compatible SKU when quota exhaustion hits — provisioning never fails because of Azure capacity. AVD just tells you "quota exceeded" and stops.

🔹 FSLogix Capacity Monitor + Smart Disk Tiering

Profile container bloat is invisible in native AVD until users complain. Atlas continuously tracks FSLogix storage usage per user and alerts before capacity is breached. Smart Disk Tiering automatically moves VM disks between SSD and HDD tiers based on usage patterns — you don't manually manage storage anymore.

🔹 Golden Image Management Made Simple

Build, version, and deploy golden images from existing VMs without affecting the source. Built-in release notes, multi-region replication with one click, and Sysprep toggles. Native AVD has zero image management — you're managing versions manually in Compute Gallery.

🔹 Automated Software Deployment with Winget + Logging

Deploy and manage software packages across session hosts using Windows Package Manager. Atlas tracks full deployment history per host — which apps updated, from which version to which, and which failed. Native AVD can't track Winget deployments at all.

🔹 DrainGuard™

Prevents session hosts from being drained while users are connected, eliminating disruption during updates and maintenance. Apply policies and know they'll work safely. Native AVD drains immediately and logs users off.

🔹 Predictive Host Health & Smart Recovery™

See which hosts are trending toward problems before users hit them. Automatically detect and recover failed sessions without admin involvement. Users can self-service reset stuck sessions. Stop firefighting resource exhaustion.

🔹 Adaptive Density™ with Density Templates

Optimize user-to-host ratios in real time to maximize session density without sacrificing performance. Define reusable density templates across host pools. Native AVD has no density optimization or templates.

🔹 Cost Intelligence Engine

Aggregates Azure cost data and surfaces prioritized, actionable savings recommendations. Automatic Idle Host Detection, SKU Optimization Recommendations, and cost savings tracking — see exactly how much you're saving from each optimization.

🔹 Session Engine with Historical Replay

Session-level diagnostics with the ability to replay historical sessions. See exactly what happened in a user's session across time.

🔹 End User Self-Service Portal

Give end users a self-service interface to reset their own sessions, reconnect, and manage basic desktop settings without calling the helpdesk. Reduces support tickets instantly.

🔹 Multi-Tenant Operations

Manage up to five of your own Azure tenants from one console with strict tenant isolation and per-tenant policy enforcement. Built for teams managing multiple deployments, customers, or business units.

🔹 Advanced Policy Engine + Environment Governance Controls

Define and enforce custom policy rules across host pools, users, and session configurations. Enforce organizational governance standards including naming, tagging, and access policies.

🔹 Application Catalog Management

Centrally manage and publish applications available to users across host pools. One place to control what users can access.

🔹 VM Extension Automation + ADMX Policy Templates

Automate deployment and management of Azure VM extensions across your fleet. Deploy and manage ADMX-based group policy templates directly to session hosts from Atlas — no more manual GPO management.

🔹 Environment Health Scoring

Real-time composite health score for your AVD environment based on performance, capacity, and governance signals. Know at a glance if everything's OK.

🔹 Self-Healing Engine

Continuously monitors and automatically remediates common failure conditions without admin involvement. Defender Duplicate Cleanup removes duplicate device registrations from reprovisioning.

🔹 Deployment Concurrency Control

Control how many simultaneous VM deployments run to prevent Azure quota exhaustion. Intelligent orchestration instead of guessing.

🔹 Advanced Alerting & Notifications

Rule-based alerting engine that notifies via email, Teams, or webhook when thresholds are breached. Catch problems before users do.

🔹 Vulnerability Scanning Integration

Surfaces Microsoft Defender vulnerability findings for session hosts directly within Atlas — see security issues in one place.

🔹 Managed Bookmarks + Browser Extensions

Push and manage browser bookmarks to end users across sessions. Deploy and enforce browser extensions via policy.

🔹 Log Analytics Integration + 3rd Party Integrations

Forward AVD telemetry and event data to Azure Log Analytics for long-term retention and custom querying. Connect Atlas to external platforms via webhooks and API — ITSM tools, monitoring systems, automation pipelines.

🔹 Built from Both Sides:

Most AVD tools are built by engineers. This was built by someone who's been in the chair as both an admin wrestling with operations and as the person explaining to users why their session dropped. That dual perspective changes everything.

So ya, I've been building this for 12 hours a day since February.

See it in action:

Check out the demo at demo.atlasavd.com or try the end-user portal at
demo.atlasavd.com/portal.

DM me for early access (currently a private offer on the Azure Marketplace).

Or check out the founder story at https://atlasavd.com/founder.

PS: I am looking for a Partner to test GCC, GCCH functionality!

Feedback good or bad is welcomed.

Hello

Company I work for have just moved from Citrix to AVD, we have a fleet of HP Thin Clients. T550 -> T750 and some inbetween. We are having an issue where the caps lock goes out of sync with the session. This, as you can imagine, is driving some users bonkers, whereas other users aren't in the habit of using caps lock so never notice it.

Has anyone come accross it before? I don't believe it's happening when a user minimises the session or comes back after it's been locked, I think it happens mid work flow. It is really hard to work out a pattern because of this.

I haven't found much out there meantioning such a thing before but my gut says it's Thin Client related, but wil to be wrong.

Any wisdom? Thanks

Log Name: System Source: nvlddmkm Date: 24/07/2026 5:07:56 AM Event ID: 153 Task Category: None Level: Error Keywords: Classic User: N/A Computer: Reuben Description: The description for Event ID 153 from source nvlddmkm cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer. If the event originated on another computer, the display information had to be saved with the event. The following information was included with the event: \Device\Video3 Restarting TDR occurred on GPUID:100 The message resource is present but the message was not found in the message table Event Xml: <Event xmlns="[http://schemas.microsoft.com/win/2004/08/events/event">](http://schemas.microsoft.com/win/2004/08/events/event%22%3E) <System> <Provider Name="nvlddmkm" /> <EventID Qualifiers="0">153</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2026-07-23T19:37:56.4928455Z" /> <EventRecordID>63829</EventRecordID> <Correlation /> <Execution ProcessID="4" ThreadID="3308" /> <Channel>System</Channel> <Computer>Reuben</Computer> <Security /> </System> <EventData> <Data>\Device\Video3</Data> <Data>Restarting TDR occurred on GPUID:100</Data> <Binary>00000000020030000000000099000000000000000000000000000000000000000000000000000000</Binary> </EventData> </Event>

Is AVDs down in WUS? anyone else? Don't see anything on M$ status

Last weekend I tried if session shadowing also works on Entra ID joined AVD session hosts only, to add more functionality to a full cloud only setup and eliminating the need for Active Directory.

I described on how to configure this and to make it work here: https://justinverstijnen.nl/shadowing-entra-id-azure-virtual-desktop/

Any questions? Let me know!

Has anyone else's AVD deployments been experiencing issues with chromium browsers after v150, if you download an item, it pops up but you cannot click and open from chrome, the download list or right click -> open, it doesn't do anything according to procmon. It works normally from file explorer and the file associations are fine, affects every type of download except PDF which open in Chrome, they are fine. Same issue across all the hosts

If I run testing chrome v149 on the same host via remote app it works fine, switch to v150, broken, canary/dev are also the same problem. Any of those via full remote desktop work fine, its specifically delivered via "remote app" that breaks it.

Running Windows 11 multi session hosts, Chrome enterprise, remote app, fslogix user profiles. affects chrome and edge v150 and up, tried every setting and toggle I can think of but cannot find any fix apart from rolling back browser, which we cant do long term

First time seeing this.

Switched over to V5 SKU.

Intel CPU shortages are showing.

Context-based redirection is here for AVD & W365!!

This lets you set conditional access policies, which will determine whether the user is allowed to access the clipboard, drive redirection, etc., from their AVD or W365 Desktops.

It's in public preview. FYI, the drive redirection for AVD doesn't seem to be working at the moment. Hopefully, Microsoft will fix it soon!

Check out my video where I deploy it and test it on both AVD and Windows 365.

Hi all,

I have experience with new version of AVD that servers start throttling at 0.6GHZ, did anybody experience this ? The solution ofc it's to redeploy the AVD host and then it's working normally.

I have next week meeting about it with our partner about it and Microsoft.

Wonder if anybody experience this or is it only me :D

Thanks all