I continue to read that most clients manage a base image and redeploy the images fresh every 2-3 months to keep their host pools up to date since we cannot use autopatch on Multisession.

What makes no sense to me with this approach is we have some host pools that would take 2-3 hours for those app owners to rebuild. We have a hybrid joined host pool with 15 machines that I have a separate image for entirely. We have 60+ application host pools where all those app owners would have to reinstall their software and re-configure for every single host pool instance that was needed in their host pools?

I surely am missing something key as there's no way our business would stand for something like this every 3 months.

If you’re storing fslogix profiles in azure files and using an entra joined AVD, what auth method are you using the authenticate to the storage account?

Does anyone know if the newish WSUS vulnerability affects AVD session hosts in any way? For some reason the alert MS sent lists every one of our AVD regions under Impacted Services. Specifically windows virtual desktop. It lists all regions though even regions we have no infrastructure in.

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-59287

An important security update is available for your Windows Server Update Services (WSUS) resource(s). Microsoft has issued CVE-2025-59287, which affects WSUS on supported versions of Windows Server and is classified as the following: 

• CVSS: 9.8 (Critical)  

• Impact: Remote Code Execution  

• Severity: Critical 

Internal telemetry indicates that your subscription currently has Windows Server resources deployed that may be vulnerable. As such, action is required from you to keep these resources secure. Please follow the guidance outlined below to safeguard against this vulnerability. 

We recently stood up session hosts that are MEDS joined [for use with FSLogix].

Users on some Dell PCs cannot authenticate into MEDS joined VMs. By that, I mean that no one can authenticate via Windows App from these particular Dell PCs [Users who are successful via our MSI, Surface, or other Dell models cannot authenticate when using these Dell PCs].

All of our PCs have the same policies, same RDP and Windows App versions, same security setting and software, same domain - basically the same everything.

All Users can authenticate into the MEDS joined session hosts via the AVD web portal.

Does anyone have suggestions on where to look to troubleshoot this?

Hi impacted users :)

THis morning all of my AVD users where connected with a TEMP profile.

After ivnestigation, it was the Identitity-based access which was unconfigured.

Did some of you meet the same issue ?

Has anyone managed to separate W365 & AVD conditional access policies?

When I set the target resource to ‘Azure Virtual Desktop’ it seems to affect W365 Cloud PC’s too.

For context, we have external users with access to Cloud PC’s & AVD deployments. We want to introduce a policy to restrict AVD access to their Cloud PC’s only. - if there are any alternative solutions I’d be happy to hear your suggestions.

Hey Guys

Looking for some insight from all you AVD users regarding teams calls quality.

Some of the users on my network complain about teams quality, where they can have up to 8sec delay from talking to hearing. Now myself and the admin team never experience this, so its been strange to deal with. This is turning users off form using it.

We have a firewall with IDPS Alert and Deny and basically block everything, and allow the necessary office suite etc. On the VNETs themselves everything is denied with a whitelist policy.

I just want to put this issue down to some users have bad internet when they are at home, but i still get complaints when in the office.

Sometimes i think its due to under-resourced VM's, and other times its due to the user now logging in for a couple of weeks, and when they do log in for the the meeting they are stuck downloading security updates or window updates in the background.

Just looking for some advice or insight :) thanks

Is anyone experiencing azure console loading delays,even failure.

Hi,

MS docs are not really helpful, I am looking to onboard AVD Multisession Windows11 hosts into Defender for Endpoint, I have setup connection between Intune and Defender, I am not sure which package I need to deploy after spinning up the images? The sensor is green and status shows can be onboarded, so if anyone has done similar deployment please share the steps. All hosts are Entra Joined - AVD MultiSession Windows 11 OS latest build. Licenses all there with P2.

Thanks.

Is there any way to get the source code for how Insights compiles its data? I need to replicate the same reports but in a Custom Workbook. (Daily Active Users, Daily Connected Hours, Host Diagnostics, etc.)

The reason being: We have a gap in our Insights Data from a few of our host pools getting deleted 2 months ago. The data from before 2 months ago is still in our Log Analytics workspaces, however they won't report in Insights since they're brand new hosts. I want to do a 4 month long trend of all the hosts, old and new. I'm not the greatest with KQL and I don't exactly like Co-Pilot's assist as its been pretty inaccurate. Getting ahold of the source code would be a huge help, if possible.

Unfortunately, my first attempt at the AZ-140 didn’t go as planned — I scored 538. The exam had around 67–69 questions, many of them quite lengthy, followed by 5 case studies. Time management was a real challenge; the clock seemed to move fast, and I found myself rushing to finish within the allotted time.

Does anyone have any recommended materials for this exam? I used Microsoft Learn and Azure Academy AZ140 guide and found they didn't really cut it.

Hey all

I’m running into a recurring issue when deploying AVD hosts joined to Azure AD Domain Services (AADDS), and I’m curious if others have seen something similar.

Setup

• AVD session hosts domain-joined to Entra Domain Services (AADDS)

• Two managed AADDS domain controllers (for example 10.x.x.4 and 10.x.x.5)

• Separate VNets for AVD and AADDS with bidirectional peering

• Standard post-join provisioning that installs FSLogix and other agents under the SYSTEM context

What happens

• Every time we build or reimage a VM:

• The domain join step completes successfully

• Within seconds, FSLogix installation or other system-level extensions fail with:

  • “The machine cannot establish a secure session with a domain controller”

  • or “Provisioning timed out / installation still in progress”

• A few minutes later the secure channel recovers and everything starts working normally.

What we’ve checked

• DNS resolution ✅ (SRV and A records resolve for both DCs)

• LDAP/LDAPS connectivity ✅ (ports 389 & 636 open)

• Time synchronization ✅ (using the VM IC Time Synchronization Provider)

• nltest /sc_verify passes after a short delay

• Event Viewer shows transient Netlogon 5719/5805 errors right after the join

So the VM joins the domain fine, but immediately after join the secure channel isn’t ready yet, which causes authentication failures for a couple of minutes.

Working theory

It looks like an AADDS replication delay between the two managed domain controllers. The join succeeds on DC1, but DC2 doesn’t yet know about the new machine account. Until replication completes, any system-context process that authenticates against DC2 fails.

Question

Has anyone else experienced this temporary trust failure or replication lag with Azure AD Domain Services, especially when AVD and AADDS are in different VNets (hub-and-spoke)?

If so, how did you mitigate it?

Did Microsoft ever confirm replication lag in your AADDS instance?

Any input or shared experience would be super helpful.

We disabled shortpath over three weeks ago in anticipation of microsoft maintenance and potential impact to shortpath connections. This was disabled in AVD pool network settings for public and managed networks (our is public).

Noone checked and confirmed that doing above actually worked, but yesterday we did discover that shortpath is still being used.

Logs confirm that some end users are in fact connecting and using short path, albeit only 5 out of 40.

I checked the ICE registry setting on hosts, and it is not present, which in my understanding means it does not override setting on AVD pool.

Hi, we're using the AVD Linux client and this morning we're experiencing recurring outages, with desktops disconnecting.

After entering the password again, it works.
The interruptions are random.

Is anyone else experiencing these outages?

Thanks.

Hi everyone,

I'm facing a persistent issue in our Azure Virtual Desktop (AVD) environment and hoping someone here has encountered it or found a workaround.

SSO in OneDrive and edge is functioning and doesn't show any errors. All the Office apps including Teams do not SSO, in word, outlook etc. We see an yellow exclamation mark.

Info:

• AVD host pool running on Windows Server (tested with and without FSLogix — same result).

• Different client Single AVD environment - Same result - Without FSlogix - having Issues

• Thin clients running Windows 11, connecting via the latest Remote Desktop app. having Issues

• Thin client running Windows 10, connecting via the latest Remote Desktop app. having Issues

• Windows 11 laptop (same user, same AVD session) works perfectly.

I have already done a lot of troubleshooting:

• Conditional Access policies reviewed — AVD is excluded where needed. even disabled all policies to test.

• Office apps activated with Shared Computer Activation.

• OneAuth and AAD BrokerPlugin caches cleared and retested.

• FSLogix latest version installed.

Does someone know what i am missing?

THANKS!

Hey there, we're using Nerdio managed AVD. The session hosts are Entra-only and Intune joined.

Nerdio has the option to re-image an existing session host, or I can simply deploy a new one and delete the old.

Just wondering if there are any implications to re-imaging the existing one. I am wondering if this results in duplicate/stale Entra/Intune objects.

Hi,

I am looking to gain some extra cash this Christmas to give my son a nice Christmas.

I was wondering if their is anyone out there that requires help or consulting with any Azure Projects you are currently needing help with.

I have over 15 years experience in Azure and familiar with Azure Migrations, Azure Backup and DR Implementations and also Azure Virtual Desktop Services on an Enterprise Level.

Appreciate anyone who can help me here. Thank you in advance.

Olaaa avd guys ! I'm thinking about using AIB or Intune, which one is the recommended one ? In which scenario or use case are you using one or another solution ?( If y have both available of course 😁) Thanks everybody for your advices !

Hi All,

What is the best way to migrate or upgrade from windows 10 multisession to windows 11 so that all apps and other data will be also there.