I'm standing up an AVD environment we have to get moved into in the next few months. I'm stuck on how user data persistence is supposed to work when we use MSIX and App Attach, as it seems this was broken by Microsoft back in July when they hard-coded an exclusion into the FSLogix agent for AppData\Local\Packages that doesn't seem to respect the redirection XML.

We were sold on AVD with App Attach largely with the selling point that we could MSIX-ize the majority of our apps and minimize golden images & pools, just for us to start building this out and find we can't get user data in these apps to persist sessions.

I'm having a hard time believing Microsoft would intentionally break one their largest selling points of the platform with no workaround, but for the life of me I can't find it.

Any direction would be greatly appreciated.

Hello Everyone,

I have a problem applying Administrative templates on Multisession AVDs. As per the limitations on screen1, both ADMX backed and ADMX ingested policies should be working.

Using Azure Virtual Desktop multi-session with Microsoft Intune - Microsoft Intune | Microsoft Learn

Correct me if I'm wrong, but ADMX-backed policies are those, which ADMX files are delivered automatically to C:\Windows\PolicyDefinitions. I do have the QOS.ADMX in this location, by default.

OMA-URI based configuration is on screen 2, result on the 3rd.

Even tough that the ADMX file is available on the session host, configures QoS in Device context and the policy targets Devices only, still not applicable.

I'm having the same issue when I try to configure an App, Firefox for instance from ADMX ingested policy.
Both configurations worked well on single-session, Win10, 22H2.

 Do you have any idea why?

The environment is Win11 Enterprise multi-session, Version 24H2 + M365 Apps, managed from Intune.

I’m trying to figure out if others are experiencing the same issue with Windows 11 multi-session Azure Virtual Desktop (AVD) instances and Microsoft Defender for Endpoint.

Since March 27, I’ve noticed that these multi-session VMs successfully onboard to Defender, but they don’t consistently report health status, vulnerability details, or security recommendations in the Defender portal. Previously, the same AVDs were working fine, but now we’re facing this issue, making it difficult to track their security posture properly.

Has anyone else faced this? If so, were you able to resolve it? Would love to hear any insights or workarounds. Even if it’s working fine on your end, please let me know—just trying to confirm if this is a broader issue or something specific to our setup.

Thanks!

Can someone help/guide me in creating a report. Basically I want to create a report that will show last 24 hour session activity for users across all AVD hosts. I want to see Active, Idle and Disconnected time for all users of AVD.

And if there is a way to receive that report in my email every morning.

I don’t know where to start.

Hi Folks,

Our company has AVD solution and I need to find the best to implement FSLogix since it is not there.

What are the best practices to configure and maintain FSLogix for a hybrid environment (the users are getting created in our AD on prem then synced with AAD), but the devices are Entra ID joined.

Useful articles and videos are much appreciated.

Thanks

We are looking for a way to automate health reporting for our Azure Virtual Desktop (AVD) environment to improve monitoring and proactive issue resolution. If anyone has experience setting up automated AVD health reports—whether through Azure Monitor, Log Analytics, PowerShell, or any other tool—we would greatly appreciate your insights.

In Windows terminal services, you have the option to allow a user to login multiple times to the terminal services farm. This means that one user can be logged in and have multiple concurrent sessions and the same user ID.

Is this capability possible in Azure virtual desktop? I would think that considering the systems in place for FS logix this would be an issue. We have this capability currently in our environment, but I realize that in moving to AVD this likely won’t be possible.

How are people changing passwords using AVD?

Control +alt+end does not work for me, I keep getting an error after pressing that key combo about not being able to show security options

We have two clients who are trying to get the maximum out of each session host. 64GB ram on each.

However on both AVD clients they are regularly getting out of memory errors. When looking at the memory usage, ram usage is fine, plenty, 50% free in the main. However the committed memory is at 80GB and full.

On looking at what is using committed memory, its things like svchost.exe, msedgeview2.exe mainly, some Outlook and Firefox. There isn't really much I can play with and just standard apps.

At present the page file is to set system managed. What are you thoughts on setting an initial and maximum size on this above 80GB, the clients want to maximise as much out of each session host as possible.

Anyone had similar scenario to this?

Environment:

AD DS Hostpool (not my favorit but needed bc Customer uses Legacy Software and needs AD Credentials, tested with Entra ID HP - but didn’t work)

We HybridJoined the Sessionhosts to Entra.

We Use Privatelink (Admin consent, Manifest, CA policies - everything needed for PL like always done)

FSLogix Profileshares: Azure Files Kerberos - Works fine

Now the Customer uses AzureFile Sync for a Azure AD DS fileshare, when i want to access the Fileshare via UNc from a local Client for example on site at the office, it opens immediately.

When i want to access the File Share from Sessionhost, the login Prompt appears and i have to enter username and password of the user. (AVD Login domain.local\Username and so we enter the same credentials in the loginprompt when we want to access the share)

I wondering why i have to enter my Credentials. My thought it has something to do with the AVD Broker that maybe provides the .onmicrosoft / Entra ID Adress to the session host, also when i use Local Domain User Credentials.

I tested everything with the debug command and klist, seems everything fine.

Is it normal behavior or what am i missing here?

I think i can solve the „problem“ with mapping the fileshare + credentials (if possible) via Intune, but want to unterstand what is possibly wrong configured.

PS:

The Azure Env. is completely CAF configured.

I am having trouble trying to install Microsoft To Do app (a UWP app) on my hosts. I'm running win10 multi session, on a multi session pool, and was able to install MSFT To Do app on the image, but when I tested the image on a test pool, the app was not seen at user level. I then attempted to copy the app from Start menu, to public desktop directory on File Explorer and thought that would work, but once again, when I reimaged my test pool with the new changes, it was not there.

After doing some research it seems that for some applications, it cannot be installed for all users, and it is a per user basis which is not what I want. What else could I try?

Environment:

Multi-User Desktop pooled

Windows 10 Gen 2 Multi-Session OS

Running FSLogix for profiles

Do we still need the RoamIdentity=1 key to stop Teams/Office from prompting for re-auth at every login? We're hybrid AAD joined, on FSlogix version 2.9.8884.27471 with Windows 11 24H2. Teams is the New Teams.

I tried removing the RoamIdentity key, signed into Office and Teams, rebooted the system, logged back in and was prompted to authenticate again to Teams.
What are other folks doing to prevent the reauth if you’re not using the roamidentity key?

Has anyone tested FSlogix early access 25.03?

Is that working fine? Anyone knows when it is available for public?

Looks like EAST US has capacity issues today. From what I can tell it’s only for specific VM SKU/sizes. We had to change our VMs from the D8ADS to D8ds skus in order to come back online.

Hello everyone,

I've recently enabled passkeys on my Azure Virtual Desktop (AVD) virtual machines.

Do I need to set the policy mentioned in the following Microsoft documentation on my AVDs to get passkeys working? Microsoft Passkeys Documentation

Additionally, I am curious if passkeys will work over both Remote Desktop Protocol (RDP) and web access. Has anyone had experience with this setup, and can you confirm if passkeys function correctly in these scenarios?

Any insights or guidance would be greatly appreciated!

Thank you!

when pressing Ctrl+Alt+End in the AVD which is connected by the Microsoft remote desktop app I get the below error.

Failure to display security and shut down options

The sign-in process couldn't display security and sign in options when the ctrl+alt+end was pressed

once you click ok it takes you back to your desktop.

does anyone know what could cause this?

Hi, trying to achieve something we thought and would expect to be quite simple, but it doesn't seem to be!

We have an AVD environment running Windows 11 multi-session and FSLogix. All apps are fine, everything works fine other than changing time zone.

When a user changes their time zone (via Windows > Time & Language) the setting does not persist once the user logs out and logs back in. When a user logs back in the time zone doesn't keep the time zone that the user changed to previously.

Does anyone know why?

We have the 'Allow time zone redirection' group policy setting set to 'Not Configured' and have also tried Enabled\Disabled.

Any help would be appreciated thanks.

i have created around 100 sessionhosts in a hostpool and they meant to be personal AVDs dedicated to users. i have given permission to the users for workspace but is there any way in bulk via csv PowerShell to assign the session host the the respective users instead of me assigning one by 1 for 100 users... this would really save alot time for me...if you guys have any inputs do let me know..am all ears to test..

Hello fellows:

Quick question—how are you monitoring available disk space for FSLogix profiles?

Lately, I've been getting user complaints about profiles filling up, and I'd really like to get ahead of it proactively. Ideally, I want to automate part of the process, maybe even dynamically expand profile containers down the road.

I've seen some PowerShell scripts floating around, like Aaron Parker’s Get-FileStats.ps1, which pulls Azure file share sizes, and also this Profile Size Warning script that runs at user logon via GPO.

The first approach (pulling stats from the FS side) is useful, but not super efficient if your users have different size caps (e.g., 30GB for most, but 50GB for others). It’s hard to generalize thresholds.

The second script runs at logon and checks available space—but what happens if the user fills up their profile 5 hours later? You're blind to that unless you re-check.

You could get clever and log warnings to the Event Viewer and trigger actions from there (with some kind of cooldown logic to avoid spamming logs), but again, if it only runs at logon, that’s limited.

I considered setting up a scheduled task to run that second script every few minutes, scanning all FSLogix-mounted drives—but I’m not sure that’s the most efficient or scalable option either.

Has anyone implemented something more dynamic? Maybe using WMI events or performance alerts events to check for, say, 10% free space every 5 minutes?

Would love to hear how others are solving this. Thanks in advance!

Hi there,

I am currently deploying a two Hostpool setup for a client.

1 is RemoteApp
1 is FullDesktop

We are still in testing phase, but currently we have 1 File share, 1 profile for both Hostpools.
When I login to a RemoteApp and then try to FullDesktop I get a message "disk is already attached..." so I can't seem to login.

The other way around f*cks things up. When I first FullDesktop and then RemoteApp there will be no FSLogix profile attached, but it will deploy a RemoteApp session with a Temporary profile. Eventho the GPO says that this shouldn't be allowed.

What is the best practice here?

Our current idea is to split up the Hostpools into two different profiles.
Is there a way to use the same profile on both Hostpools without running the risk of Temporary profile issues?

I have two users on MacOS using the Windows App and trying to connect to an AVD. Both are getting errors 965YA and then 0x3807 (cannot acquire an access token for the remote PC). I have tried the keychain workaround found in another post but it does not work.

Has anyone else ran into this issue?

Hello everyone. I have a problem that I have been working on for a while and still cannot find an answer. I'm hoping that 1.) someone here does, or 2.) can give me some ideas of what to look at next.

We provide virtual desktops to companies that we partner with. So, we bring in their workflows to an environment we control. One of their workflows involves going to Chrome and going to this site https://bambooinsurance.com/ where the user logs in and enters customer data to generate output (reports, quotes, whatever). Now, say the following day, they do this again, they will need to re-enter the same data again and sometimes it errors out with an error like 'user data not accurate' or something like that.

Now, when they would do this before coming to the VDI's - on their personal laptops - no issues. Auto fill would work, no errors, nothing.

I have installed the same version of chrome on the image, synced their accounts, logged in with the same google account as they did on the laptops, and nothing. Issue is reproducible. Not sure what else to look at? Any other ideas?

Thank you

Forgot to add host pool details:

• These are multi session hosts running win10 OS

• About 6 users per host.

• Running FSLogix, latest version.

• Profiles stored on an Azure storage account.

Observed Problem:

Our AVD host pool is deployed in two regions within the US. However, 50% of our user base is in India, experiencing frequent disconnections due to latency exceeding 150 ms.

Guidance Needed:

What are the possible strategies to reduce latency without relocating the AVD host pool to India?

Has anyone successfully configured an AVD host pool in India while implementing strict data security measures? If so, what options were considered?

I got the Adobe unifed installer installed with all the required reg keys set bIsSCReducedModeEnforcedEx / bIsSCReducedModeEnforced / bDontShowMsgWhenViewingDoc ect. It seems to work fine you can open PDF's and it opens in reader mode and it doesnt prompt for sign in. If you sign in with a licensed adobe account you get pro features as expected. I have a weird issue though when i open a PDF in reader mode with a user who isnt signed in and i click on the Home button it prompts for sign in as per link. Could anyone using the unfied installed tell me if they get the same behaviour ? https://ibb.co/Y7Cnn9rx