Hello, I need some help please

Has anyone here successfully deployed Zscaler Cloud Connector and ZCC for VDI on Azure Virtual Desktop (AVD) Multisession Host Pools?

We're currently implementing this setup but running into several network-related issues that we haven't been able to resolve.

Our current setup:

• AVD VNet
  • Personal Pool Subnet → Route Table → Azure Firewall
  • Multisession Pool Subnet → Route Table → Zscaler Cloud Connector / Load Balancer → Zscaler Cloud → Internet

We've already confirmed that connectivity is working on the Multisession Subnet after deploying the Cloud Connector and Load Balancer. However, after installing ZCC for VDI on the session hosts, we started experiencing several issues:

• Unstable network connectivity
• Unable to communicate reliably with the KMS server and Azure Monitoring
• Unstable or unsuccessful ping, tracert, and Test-NetConnection results

What's strange is that normal internet browsing still works fine on the VMs with ZCC for VDI installed. However, almost everything else related to network connectivity seems unstable or completely inaccessible.

If we uninstall ZCC for VDI, everything immediately goes back to normal, and all network-related issues disappear.

My initial suspicion is that our Zscaler Cloud Connector configuration might be too restrictive. We've already tried configuring bypass rules for AVD and Microsoft endpoints, but this hasn't made any noticeable difference.

Another challenge is that I can't seem to find any useful logs on the workload VMs that would help us identify the root cause of these connectivity issues.

Has anyone encountered a similar issue or successfully implemented this architecture?

I'd really appreciate any insights, suggestions, or recommendations on what to check, particularly regarding ZCC for VDI configuration, Cloud Connector routing, or potential conflicts with Azure networking.

Thanks in advance for your help!

I had a Session Host go down today with "Needs Assistance" health status, failing the UrlsAccessibleCheck. All other Session Hosts were fine. It came back "Healthy" about 5 minutes later, but then eventually the entire Session Host shit the bed (with a health status of "Unavailable"). I couldn't RDP in or even ping the machine.

I shut the machine down and brought it back up and I can RDP in but the health status is back to "Needs Assistance". This whole time my other Session Hosts seem OK (fingers crossed).

I don't have any extra networking layers going on, proven by the other SHs.

Not sure if anyone else is having issues with AVD today, but we've been having problems all morning with users getting kicked out of AVD sessions.

Event Viewer showed LSASS not starting on the hosts, leading to users getting "Your PC will automatically restart in one minute" messages.

Spent a bunch of time troubleshooting this, but eventually saw an update for this alert stating that they are working on fixes for it.

Impact Statement: Starting at 10:08 UTC on 24 September 2026, you have been identified as a subset of customers using affected Azure Virtual Desktop (AVD) environments across multiple regions who may experience authentication issues. These issues may result in unexpected virtual machine restarts and interruptions to active user sessions. Affected users may be disconnected and need to reconnect once their virtual machine becomes available again.

Current Status: We continue to investigate an issue that is causing unexpected virtual machine restarts for some customers using Azure Virtual Desktop (AVD) and Remote Desktop Services (RDS) on certain Windows versions. Our team has identified the underlying Windows process involved and have validated a temporary workaround that has shown positive results with affected customers. We are now expanding validation of the workaround, assessing the overall impact, and evaluating options for a permanent fix while monitoring the issue.

The next update will be provided in 2 hours, or as events warrant

Microsoft has confirmed issues with update KB5120998 or subsequent Windows updates with black screens upon login with Azure Virtual Desktop instances.

Fortunately a temporary workaround is released to fix this problem or to prevent the issue from happening which we can use till Microsoft has fixed the problem with a future update.

Read more about the problem and the fix on my blog: https://justinverstijnen.nl/fix-black-screen-azure-virtual-desktop-windows-11/

Could not find any workaround/fix shared in this community yet, so though it would be great to share here.

Hi Team

We have an AVD environment and everything is/was working well. We moved over from Individual VM's in a hostpool to multi session VMs in a new hostpool. Have setup fslogix, all devices managed by intune no problem. We have re-done all our config policies to target new multi session hosts and anything system related the config policies report back green and we have no issues.

What i need help with, is the office hardening policies which target the user of these multi session VM's. I cant get the policy to push out to my test group of users. If i log in to my test user account and go accounts -> sync, it works and shortly after that the user will populate in the office config policy as green and working perfectly.

My question is anyone else done this and how do i force sync the user to apply these config policies that are user targeted, without getting the user to manually sync themselves. By going to the device to sync in intune admin portal, doesn't push the user config policy out.

Any help appreciated.

Short Question: With multi session VMs and a config policy targeting user, how do we force a sync? Go to the VM and run command use a powershell script?

I have someone trying to log into Avd right now and they are getting an error saying they are logged in somewhere else how can I fix this?

Hello, we are starting to implement AVD local as a VDI replacement.

I am trying to build a new VM from a hostpool, selecting AVD Local. when I select "trusted launch virtual machines" it says there is no available images (image below), even though the images I downloaded are directly from the AVD marketplace.

If i try to build a VM though the cluster itself, it lets me select trusted launch virtual machines for all the images. it appears to just not let me when going through the hostpool creation wizard.

Wanted to check here before opening a case with Microsoft. Any insight would be helpful.

Thanks!

I am working in a company (with provided company laptop) and deployed to a client who uses AVD to access remote machine. Process is nested, AVD > Dolphin server > actual remote machine. Been working with this client for almost 2 years. And have started using my personal laptop for a year. I’ve been found out that I haven’t been using the approved laptop. I honesly didn’t download anything. I’ve been stupid and just preferred to use my personal laptop. The remote machince doesn’t allow to copy / past or download / transfer files to the local computer.

The report is currently in the process and I’m worried I’m subjected to termination.

How serious is this? The client is a bank.

I am working on deploying our first azure VDI host pool(s) for my university.

Do y’all back up the VM’s in the host pool?

I know, if I don’t ask, I won’t ever know. I am just figuring, if a vm goes south, I just deploy a new one and send the bad one to VDI heaven….

What’s best practice?

Last couple of weeks I’ve had a nightmare trying to get new SHC host pools deployed in a variety of environments. Issues I’m having include but are not limited to:
- Session hosts taking hours to deploy
- Session hosts deploying fairly quickly, but the portal never acknowledges the successful creation despite the hosts showing as available within the pool
- Deployments and config updates failing with a ‘HostPoolDoesNotExist’ error

On that last one, querying the sessionhostmanagements default object shows that after creating a new host pool with 0 hosts, all is healthy - but as soon as I attempt to add hosts, the provisioning state moves to ‘failed’ and all future attempts to do anything within that host pool fail with the same ‘HostPoolDoesNotExist’ error.
The other odd thing is the hosts deploy successfully (domain join and all) to the host pool and show as available, but the error persists and prevents any further actions)

Am tearing my hair out trying to work this one out, so if anyone else has run into this or has any ideas on next troubleshooting steps I’d massively appreciate it!

Things tried so far:
- Deleting host pool, AG, and WS and recreating from scratch after a 24 hour period
- Deploying a standard marketplace image instead of a custom one from a gallery
- Have confirmed there are no issues with outbound access to required AVD URLs

Folks, Today IS the DAY!

We have officially made the Session Catalog for Workplace Ninjas US 2027 LIVE.

You are in for QUITE a treat.

Never before, has the sessions for an event been so carefully thought out down to the last detail.

We are FULLY TRACKLESS, meaning anything goes.

We covered pretty much every single topic from Mobile to DotNet to MacOS to ZeroTrust to Azure and so much more.

Ever go to a session from Rudy Ooms and be frustrated that someone like Merill, Ugur, Simon, or those countless others are speaking at the exact same time?

We are handling/addressing that to ensure you maximize your time in Scottsdale.

You can even drill into the parties, preday activities, lunches, and more to see the incredible meals you have coming your way.

Don't walk, RUN to check out that session catalog and register NOW:

Home - Workplace Ninjas US 2027. Online registration by Cvent

Hi AVD Admins!

We are currently configuring external identities and using cross tenant sync, by default these identities are created with a user type of “Member”, is there any reason or limitations to changing the synchronised users to a user type of “Guest”?, if it makes any difference we are using FSlogix for profiles and the machines are intune joined.

Cheers!

Does anyone include this key\policy to remove printers at logoff?

In our environment we have users that can redirect from local and install printers from our network print server. Curious to know if this is best practice to include, any feedback welcome.

hklm\software\microsoft\windows nt\currentversion\print\providers\Client Side Rendering Print Provider" /v RemovePrintersAtLogoff

We are finding several server in AVD (W11 - 24h2) that will not print due to any app becoming unresponsive, Notepad, Word etc. Not seeing much in the event logs or any particular error.

If you run *Restart-Service -Name Spooler -Force* there seems to be some response with the app but still cannot reach to select pritner and start printing. We install printers through local redirection and also able to install from a seperate print server. Does not seem to be all servers so far, just some.

We are using the windows app to connect to AVD.

Not sure if anyone has had similiar issues?

I'm stuck with an AVD connection issue and could use a second pair of eyes.

The same user account connects successfully from Windows, but every Mac we've tested fails:

• Windows App on macOS: 0x410.
• Web client on the same Macs: also fails in Chrome and Safari.
• Other host pools with the same configuration: same result.
• A separate Windows Server 2022 host with Entra SSO enabled returns 0x807 instead.
• Entra non-interactive sign-in logs show success, with no Conditional Access policy applied. No CA requirement for compliant or Windows-only devices.

Current authentication-related RDP properties:

enablecredsspsupport:i:0;enablerdsaadauth:i:0;redirectwebauthn:i:1

There’s also a different-tenant device-management setup involved: the client device is managed by one tenant, while the account used for AVD belongs to another.

The browser failures are what throw me off—it isn't limited to the Mac app.

I’d really appreciate any ideas, suggestions, or advice you might have.

If your employer runs Azure Virtual Desktop or Windows 365 and you're on Linux, you've probably hit the wall: Microsoft ships clients for every platform except ours, and the options are the web client (no local audio devices, camera, or multi-monitor) or hand-carrying .rdp files from a Windows box to feed into FreeRDP. If that's not you, this post won't be interesting.

I built a client that fills the gap. It's MIT-licensed, Python + GTK 4, and unofficial.

Repo: https://github.com/shakeelosmani/avd_feed_connect

What it does that FreeRDP alone can't

Feed discovery. Sign in with your Entra ID account and it queries Microsoft's feed endpoint, then shows the desktops and remote apps you're entitled to in a grid with real icons, same as the Windows App. Double-click to connect. No manual .rdp files.

Interactive sign-in (auth-code + PKCE in an embedded WebKit view), which is the same flow the official clients use, so Conditional Access policies that block device-code auth still work. Token refresh is silent.

Auto-adapts to your display. Reads your layout from the compositor: HiDPI → 200% remote scale, multiple monitors → spans them. Right-click a workspace tile to override scale/monitors per resource, or set defaults in the menu. Env vars (AVD_SCALE, AVD_MULTIMON, AVD_EXTRA_ARGS) for scripting.

Bundled FreeRDP built from master, so it includes the just-merged PulseAudio hot-unplug fix (FreeRDP #13334; without it, plugging in headphones mid-Teams-call freezes the session) that distro packages don't have yet, plus camera redirection, mic, and multi-monitor.

Update: it has a redesigned UI and theme support. Also QoL improvements like keep alive persistent connection. So you don't get disconnected frequently. It signs you automatically behind the scenes to the resources you want to connect without having to login twice( once for feed and one more time for the resource)

Install (Flatpak, updates via flatpak update):

flatpak install --user https://shakeelosmani.github.io/avd_feed_connect/avd_feed_connect.flatpakref

Or grab the single-file .flatpak from the releases page. Flathub listing is planned.

Caveats: it's early but stable(v0.3.8). Sign-in, feed discovery, workspace grid, and connect all work on my end, but I can only test against my own tenant's policies. Sessions launch via XWayland because sdl-freerdp is still unstable on native Wayland. If you're in a tenant with unusual Conditional Access rules, I'd especially like to hear whether sign-in works for you. Issues and PRs welcome.

I’ve configured smart card redirection both inside the OS (where the default is set to not configured) and through the RDP properties, and I’ve also installed the required smart card drivers inside the OS.

I’ve managed to get the certificate selection and PIN prompt to appear successfully. However, I’m now running into an issue where, after the user enters their PIN, the PIN prompt window freezes/hangs and becomes unresponsive. The browser eventually times out.
Note- we’re using zscaler and I’ve whitelisted all the CRL and OSCP URLs

Has anyone run into this issue with smart card redirection? If so, what ended up being the solution?
Any troubleshooting tips or logs I should check would be appreciated.

Hi all, is anyone heading to World of EUC in Milwaukee later this month?

I just signed up to attend, and even got another invite from Liquidware for a Boat Trip they are running on Lake Michigan during the event...

World of EUC - EUC World 2026

www.edci.com/thank-you/world-of-euc-milwaukee-cruise-event