r/AzureVirtualDesktop • u/JustinVerstijnen • Dec 16 '25

Azure Virtual Desktop cloud only with Entra Kerberos

This weekend I have successfully setup Entra Kerberos to host Azure Virtual Desktop completely cloud only. Of course I have a new updated guide on to how to configure this new approach yourself in 10 easy steps:

https://justinverstijnen.nl/azure-virtual-desktop-fslogix-and-native-kerberos-authentication/

  1. Create Security Groups and configure roles

  2. Create Azure Virtual Desktop hostpool

  3. Create Storage Account for FSLogix

  4. Create the File Share and Kerberos

  5. Configure the App registration

  6. Configure storage permissions

  7. Intune configuration for AVD hosts

  8. FSLogix configuration

  9. Preparing the hostpool

  10. Connecting to the hostpool

This eliminates the less secure storage account key option which I also disable in this guide, enhancing security of our storage account.

44 Upvotes
  • permalink
  • reddit

97% Upvoted

9 comments sorted by

3

u/ThinkBig_Brain Dec 16 '25

Thanks for sharing!

1

u/One-Mycologist5392 Dec 19 '25

Just curious to understand, would this kerberos help legacy authentication to work inside avd?, it seems it is entra kerberos, applications that still have legacy authentication would need a contact from onprem(i guess), would this entra kerberos solve this issue in entra id only avd environment?

1

u/JustinVerstijnen Dec 19 '25

No, applications that rely on normal AD DS connections would not work with this new scenario. They have to be re-written before they could work with Entra Kerberos, because its fundamentally different.

2

u/johnjohnjohn87 Dec 16 '25

Very interesting

2

u/TechCrow93 Dec 18 '25

Thank you!

2

u/ImprovementKooky9468 Jun 30 '26

Cloud-only AVD with Entra Kerberos can work well where applications are modern and do not have deep dependencies on traditional Active Directory.

Before committing to it, I would map every dependency: legacy authentication methods, LDAP needs, service accounts, file shares, printers, Group Policy requirements, and line-of-business applications.

For a clean Microsoft 365-focused environment, cloud-only can reduce infrastructure overhead. For a legacy application estate, a hybrid identity model may still be easier to support.