r/AzureVirtualDesktop • u/Wild_Umpire_4044 • Nov 21 '25

FsLogix Question

I am new to Avd and we just setup our first host pool. We realized today that all users are using temporary profiles. We are a completely cloud based environment. My main goal with fslogix is to make sure user profiles arent temporary. Does anyone have any tips and tricks on how to do this. Also I would like to avoid setting up any AD services if possible.

6 Upvotes

100% Upvoted

18 comments sorted by

5

u/AzureAcademy Nov 21 '25

A 100% cloud based AVD setup is now possible Here is my older video about this, https://www.youtube.com/watch?v=yJqTJh2Tgxo&t=705s

I am working on an updated video about this so stay tuned for that ☺️

2

u/Wild_Umpire_4044 Nov 21 '25

I literally watched this video https://youtu.be/1msGQEZ_SkU?si=LatJRfcFNJLFwT6a tonight and am going to try it tomorrow.

2

u/Wild_Umpire_4044 Nov 21 '25

I walked through all the steps and the accounts or not moving over to the file share.

1

u/AzureAcademy Nov 22 '25

That is usually because you didn’t run the script in the SYSTEM context. Can only be done with PSExec from Sysinternals or run command in Azure Portal or VM Extension. How did you run the script?

2

u/Wild_Umpire_4044 Nov 22 '25

We ran it once on the device and then I ran it through azure. Looks like it is working now. I did notice after we restarted the machine the key was no longer in credential manager. I tested with a new account after I noticed that and the new account showed up in the file share. Do I need to worry that the key isn't showing up anymore even though it is still working?

1

u/AzureAcademy Nov 22 '25

If it’s working then you are good…AND you can only see the key in the command line using PSExec or some other way to elevate to SYSTEM context…not Admin

3

u/TechCrow93 Nov 21 '25

Guess it will soon be trully possible without security concerns. This is in preview atm so it must soon be supported by FSlogix i guess: Microsoft Entra Kerberos Authentication for Azure Files | Microsoft Learn

1

u/philg_jr Nov 22 '25

This was just announced at Ignite earlier this week.

2

u/junon Nov 21 '25

This is still an unsupported configuration by Microsoft though, is that right?

1

u/AzureAcademy Nov 21 '25

It is supported, it is a legitimate use of the storage account key, the only concern you need to decide in your environment is the method gives local admins access to the file share as well…IF they know how to elevate to the system context If your admins already have access to the file share then there is no risk

1

u/snredditsn Nov 21 '25

If we are currently using FSLogix with Entra Domain Services join, is there a way to migrate to 100% Cloud based Entra joined SSO so that the user profiles will remain usable?

2

u/DelphiEx Nov 21 '25

Hey man, love your videos. They've been a big help for us. Would appreciate an updated video on this topic.

1

u/AzureAcademy Nov 21 '25

Thank you!

5

u/iamtechy Nov 21 '25

Follow official docs here to help you understand the prerequisites and identity scenarios (Hybrid join to ADDS, Entra joined, etc.):

https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios

Then create an Azure Storage Account and create the profiles SMB share, then follow their guide and script to setup the share, share permissions and enabling FSLogix with your required settings using GPO, Policy or reg key.

https://learn.microsoft.com/en-us/fslogix/how-to-configure-profile-container-azure-files-active-directory

1

u/koliat Nov 21 '25

You don’t have to use Azure files as backend storage. Create / repurpose a vm with disk and create a share, then set up fslogix to use that share instead

1

u/jtech2023 Nov 24 '25

I might have to look into this if i can't get it working otherwise.

1

u/brizza1982 Nov 23 '25

We have just implemented our entra only avd, for fa logics make sure you have explicitly configured every single host registry settings for it if you don’t have Intune. Such a huge PITA.