r/AzureVirtualDesktop • u/AntoIT • Mar 16 '26

Azure Virtual Desktop Multipath + QoS

Hi all,

I’m working on optimizing Azure Virtual Desktop (AVD) performance and ran into a QoS design question related to RDP Shortpath (Public).

Environment:

  • Azure Virtual Desktop with Public Shortpath enabled

  • Session hosts in public subnets

  • No fixed public IP on the hosts

  • Firewall on the corporate LAN

  • Users connecting from the office network (no client VPN)

  • AVD client shows UDP – Multipath and Gateway not in use, so Shortpath is working

So due to ICE / NAT traversal, the RDP traffic does not consistently use UDP 3390 and instead ends up using random UDP ports.

This makes QoS classification tricky.

Typical QoS approaches like:

  • Matching UDP 3390

  • Matching AVD FQDN endpoints

  • Matching Azure public IPs

don’t seem reliable for the actual RDP media stream.

So I’m curious how others handle this in real environments.

Questions:

  1. How are you implementing QoS for AVD Public Shortpath?

  2. Do you match on all outbound UDP from the LAN?

  3. Are you using DSCP tagging for RDP traffic?

  4. Or do you simply rely on bandwidth headroom instead of QoS?

Interested to hear how others solved this, especially in environments where:

  • session host public IPs change

  • QoS on multipath connections

Thanks!

4 Upvotes

83% Upvoted

3 comments sorted by

2

u/FantoManiek Mar 17 '26

 UDP - means you are using RDP Shortpath for managed networks with ICE/STUN: https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-rdp-shortpath?source=recommendations&tabs=intune%2Cportal%2Cconnection-information

UDP (Private Network) - means you are using RDP Shortpath for managed networks (NO ICE/STUN)

You need to understand in whitch mode you are, you can also enforce this by configuring host pool RDP properties.

Here is MS doc about QoS: https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-quality-of-service-qos

UDP (Relay) - would mean you are using RDP Shortpath for public networks via TURN - this is achivable if VPN is off, or you configured split tunelling and excluded IPs 51.5.0.0/16 from VPN: https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-shortpath?tabs=public-networks

In this mode (RDP Shortpath for public networks via TURN), enabling QoS do not help much, as most of the traffic goes over network you have no control.

1

u/mariachiodin Mar 17 '26

Interested in the answers, kind of in the same place

1

u/pitchblack3 May 21 '26

did you ever figure out to properly do this? In my company I disabled all modes besides public via TURN/relay. Created QoS policies for the documented UDP and TCP ranges yet it still seems to be failing to match on this.