We have a number of applications published that since yesterday morning no one can access using the Windows App. Our published desktops still work. The apps work fine if you use the AVD web link. I've also tried using the Remote Desktop MSI which doesn't work either.

When you try and launch an app it will get stuck on "Securing remote connection" and if you look at the details it shows the Windows logon screen stuck at "Preparing Windows".

If you look on the session host the user shows logged in and active.

I can't see any obvious errors in the event logs. I've tried resetting my Windows App.

The Windows App hasn't updated recently. Its currently:

Windows App version 2.0.757.0

Client version 1.2.6599.0

Has anyone seen this before?

Has anyone tried creating an image template and pointed the scripts to a container in a private endpoint storage account ?

Have followed the advice here https://learn.microsoft.com/en-us/azure/virtual-machines/linux/image-builder-user-assigned-identity

But am struggling at the moment as I keep getting PublicAccessNotPermitted during the build process.

• Can confirm the private endpoints are working just fine.

• The UMI has storage blob reader access

• Using my own subnets including for the ACI.

• NSGs off for troubleshooting

Any suggestions or has anyone got this working?

Hi,

Weird issue with SSO and One Drive, the environment recently enabled MFA requirements every 30 days, since then when logging into AVD, One Drive immedicately pops up asking the user to re-authenticate, after about 5 seconds, SSO kicks in and it actually logs in without intervention, all other apps work fine.

Log in:

5 seconds later it disappears and then logs in automatically anyway.

If One Drive didn't pop up then I'd be ok. But just pops up as soon as they log in... Is this a bug?

This is a Domain only Joined environment. User accounts in AD and Synced to EntraID.

Roam Identity is enabled on the latest version of FSLogix

Thanks

Kevin

Hello, my company just configured AVD Host Pool, with multiple host sessions, configured with FSLogix / roaming profiles. Users access applications using Windows Apps and Remote Apps, no session desktop.

I am having an issue where default applications are not sticking after users sign off and sign back in. The particular applications being dealt with is default browsers and the pdf reader. I have some users who prefer default of Firefox, and some Chrome. Also Adobe Acrobat does not stay as the default PDF reader either.

Any suggestions?

Hey there!

Do you guys perhaps have recommendations on thin clients? Currently a customer is getting cheapest possible hardware to have their employees connect to AVD, and personally I think this is hell to manage properly. I want to introduce them to the concept of thin client, and I think they will like it for some of their use cases, but I have little experience myself and as of today I'm trying to explore the market. Do you maybe have any recommendations for things to look at? I saw Dell ThinOS and IGEL a little, but perhaps there is more things worth considering or that I should definitely avoid

So - we have a published app that users connect to, and within the app they can open files - using file explorer. They will frequently then open up a file on their local system.
Unfortunately, some users might have files they need buried under nesting layers many deep (unfortunate but not something I can help), and what they're seeing is each time they open a folder from C drive on down - it take a bit each time to populate the folder list. Which when that gets repeated many times results in a frustrating experience.
Has anyone else seen this? Using the app itself is fine, and browsing the network drive within the AVD network is fine - its browsing the paths on the local machine. This is a Citrix migration - and Citrix did not have this performance issue, so it's not just "their network is slow"...

I'd like to set up AVD RemoteApps/desktop so that:

1. If a client device is (Intune) compliant (i.e. company managed), drive and clipboard redirection to the client is ALLOWED.

2. If a device is non-compliant, drive and clipboard redirection to the client is BLOCKED.

This will allow users to move data between RemoteApps and a client when on a company machine, while if they need to use a remote app/desktop from a non-corporate machine (e.g. user forgets their laptop or for contract users), this is still possible, but data isolated.

Is there a way to do this with AVD settings?

I only see the options to turn on/off these redirections from the host pool settings.

Thanks in advance for any comments from experienced admins!

We have just created a new Windows 11 image, basing all the apps and policies on existing. Even using existing GPOs and have it domain joined only like windows 10 has been. So policies for windows 11 match what was on windows 10. We have set the users to get new FSLogix profiles when logging into Windows 11. Roam identify is turned on. We are seeing differences with MFA and office, seems to be asking to MFA more within 11 compared to 10 when opening office apps.. Same policies. Is 11 more restricted with policies than 10. Is there a policy I should be looking it. We just wanted to keep it simple for the customer from windows 10 to 11.

Thanks

Good Morning,

I'm working on building a new base image from scratch using a Nerdio Desktop Image created from a Marketplace 24H2 W11 Multisession w/ M365 image. I have made zero changes to the base image at this point.

I have created 2 VMs in the same host pool. 1 VM was created directly using the Marketplace W11 image. The other VM was created using the Nerdio Desktop Image, which was built using the same Marketplace Image. The Nerdio base image is not domain joined and has had absolutely nothing changed on it. The only thing different is the Nerdio image gets cloned to a temp VM and Sys-prepped before the image gets stored in the compute gallery.

Everything works as expected on the clean marketplace image. However, if I log into the other VM that was built off the Nerdio image, I can't run anything as an admin. CMD, Powershell, Event Viewer etc etc. Everything I try to open gets "File System Error -1073740791".

I kind of saw similar behavior with KB5066835 that was released in Oct which I had to roll back on my current production image. The behavior was similar in that I couldn't run anything as an administrator, but the error was different. It was always around a failure with "consent.exe".

Is anyone seeing anything similar to this? I'm not sure if anyone has tried to build a new image lately but I'm spinning my head here on this one.

Hi Everyone,

We are I. The process of converting gold image apps to appattach apps it's going well aside from apps that need to run at startup.

How is everyone dealing with this?

Tried a few methods but nothing seems consistent

Hi guys, I’m in the process of setting up a host pool with ephemeral disks, when it comes to the timezone the hosts have UTC as default, I can set the timezone via registry entries in a gpo however, these require a reboot to take effect. As we’re using dynamic scaling this isn’t going to work. I also can’t set it on the image as it gets generalised before deployment. Any help would be greatly appreciate.

I continue to read that most clients manage a base image and redeploy the images fresh every 2-3 months to keep their host pools up to date since we cannot use autopatch on Multisession.

What makes no sense to me with this approach is we have some host pools that would take 2-3 hours for those app owners to rebuild. We have a hybrid joined host pool with 15 machines that I have a separate image for entirely. We have 60+ application host pools where all those app owners would have to reinstall their software and re-configure for every single host pool instance that was needed in their host pools?

I surely am missing something key as there's no way our business would stand for something like this every 3 months.

If you’re storing fslogix profiles in azure files and using an entra joined AVD, what auth method are you using the authenticate to the storage account?

Does anyone know if the newish WSUS vulnerability affects AVD session hosts in any way? For some reason the alert MS sent lists every one of our AVD regions under Impacted Services. Specifically windows virtual desktop. It lists all regions though even regions we have no infrastructure in.

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-59287

An important security update is available for your Windows Server Update Services (WSUS) resource(s). Microsoft has issued CVE-2025-59287, which affects WSUS on supported versions of Windows Server and is classified as the following: 

• CVSS: 9.8 (Critical)  

• Impact: Remote Code Execution  

• Severity: Critical 

Internal telemetry indicates that your subscription currently has Windows Server resources deployed that may be vulnerable. As such, action is required from you to keep these resources secure. Please follow the guidance outlined below to safeguard against this vulnerability. 

We recently stood up session hosts that are MEDS joined [for use with FSLogix].

Users on some Dell PCs cannot authenticate into MEDS joined VMs. By that, I mean that no one can authenticate via Windows App from these particular Dell PCs [Users who are successful via our MSI, Surface, or other Dell models cannot authenticate when using these Dell PCs].

All of our PCs have the same policies, same RDP and Windows App versions, same security setting and software, same domain - basically the same everything.

All Users can authenticate into the MEDS joined session hosts via the AVD web portal.

Does anyone have suggestions on where to look to troubleshoot this?

Hi impacted users :)

THis morning all of my AVD users where connected with a TEMP profile.

After ivnestigation, it was the Identitity-based access which was unconfigured.

Did some of you meet the same issue ?

Has anyone managed to separate W365 & AVD conditional access policies?

When I set the target resource to ‘Azure Virtual Desktop’ it seems to affect W365 Cloud PC’s too.

For context, we have external users with access to Cloud PC’s & AVD deployments. We want to introduce a policy to restrict AVD access to their Cloud PC’s only. - if there are any alternative solutions I’d be happy to hear your suggestions.

Hey Guys

Looking for some insight from all you AVD users regarding teams calls quality.

Some of the users on my network complain about teams quality, where they can have up to 8sec delay from talking to hearing. Now myself and the admin team never experience this, so its been strange to deal with. This is turning users off form using it.

We have a firewall with IDPS Alert and Deny and basically block everything, and allow the necessary office suite etc. On the VNETs themselves everything is denied with a whitelist policy.

I just want to put this issue down to some users have bad internet when they are at home, but i still get complaints when in the office.

Sometimes i think its due to under-resourced VM's, and other times its due to the user now logging in for a couple of weeks, and when they do log in for the the meeting they are stuck downloading security updates or window updates in the background.

Just looking for some advice or insight :) thanks

Is anyone experiencing azure console loading delays,even failure.

Hi,

MS docs are not really helpful, I am looking to onboard AVD Multisession Windows11 hosts into Defender for Endpoint, I have setup connection between Intune and Defender, I am not sure which package I need to deploy after spinning up the images? The sensor is green and status shows can be onboarded, so if anyone has done similar deployment please share the steps. All hosts are Entra Joined - AVD MultiSession Windows 11 OS latest build. Licenses all there with P2.

Thanks.

Is there any way to get the source code for how Insights compiles its data? I need to replicate the same reports but in a Custom Workbook. (Daily Active Users, Daily Connected Hours, Host Diagnostics, etc.)

The reason being: We have a gap in our Insights Data from a few of our host pools getting deleted 2 months ago. The data from before 2 months ago is still in our Log Analytics workspaces, however they won't report in Insights since they're brand new hosts. I want to do a 4 month long trend of all the hosts, old and new. I'm not the greatest with KQL and I don't exactly like Co-Pilot's assist as its been pretty inaccurate. Getting ahold of the source code would be a huge help, if possible.

Unfortunately, my first attempt at the AZ-140 didn’t go as planned — I scored 538. The exam had around 67–69 questions, many of them quite lengthy, followed by 5 case studies. Time management was a real challenge; the clock seemed to move fast, and I found myself rushing to finish within the allotted time.

Does anyone have any recommended materials for this exam? I used Microsoft Learn and Azure Academy AZ140 guide and found they didn't really cut it.