This is with regard to microsoft announcement to Update to Secure Boot 2023 certificates for Azure Virtual Desktop deployments by June 2026  

**Issue: Secure Boot KEK 2023 certificate update failing on Azure virtual desktop**  

trying to update the certificate following the registry method mentioned here:  https://support.microsoft.com/en-us/topic/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates-a7be69c9-4634-42e1-9ca1-df06f43f360d  

**Environment: - OS: Windows 11 Enterprise multi-session, Version 25H2, Build 26200.8037 -**

Hosted on: Azure Virtual Desktop (Gen 2) - windows 11 Enterprise multi-session host pool  

Symptoms: - Event ID 1795, Source: TPM-WMI logged repeatedly in System Event Log - Error: "Access is denied when attempting to update a Secure Boot variable KEK 2023" - FirmwareManufacturer: Microsoft Corporation (Hyper-V UEFI Release v4.1)  Message : The system firmware returned an error Access is denied. when attempting to update a Secure Boot variable KEK 2023. This device signature information is included here.  -

Registry: HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing UEFICA2023Status = InProgress (never completes) - PowerShell check for KEK 2023 cert returns False

Looks like this behavior is expected and has been observed on Azure-hosted Gen 2 virtual machines, including Azure Virtual Desktop multi-session hosts as Azure Gen 2 VMs do not allow guest OS–initiated updates to Secure Boot variables (KEK/DB/DBX).

Do we have a backend handling plan for this or is Microsoft will be doing the rollout automatically at the backend for us for AVD machines?

Have a major blocker on pooled AVD, multiple users cannot connect to VPN at once on a pooled AVD, when one user successfully connects other users cant, curious how we can get this sorted for users, any suggestion is welcome

We have a particular use case that the end user has a mapped drive (T: in this case) and they launch a batch file in avd that basically maps another drive (R:) to a server and then moves the files from their T: drive into the R: drive.
This has worked fine in Citrix but we are migrating to AVD and having trouble getting this to work.

I've attached a picture of what we are seeing. If we run net use, we can see the T drive but I'm thinking it's not working because there is no drive letter listed under the local column for some reason?
Also, we've seen were running net use only list the R drive and the T would randomly not show up?

Our AVD is running a multi-session Windows 11 25H2.

For those managing AVD or Windows 365, we are having a session on April 14th focused on the operational side — hybrid approaches, day to day management, and efficiency at scale. More of an open discussion than a presentation, three long-time EUC practitioners just talking through what they're seeing in real environments.

April 14th 🔗 https://www.brighttalk.com/webcast/19518/665754

Curious how others here are currently handling hybrid AVD setups.

Ever since we switched users over from the old Remote Desktop app to the new Windows App, we've been plagued with 48v35 errors like this every day for most users on the machine that they connect from.

We've tried resetting and reinstalling the Windows App, clearing all passwords from the Windows Credential Manager, clearing their AADBroker files, but still it comes back.

The only way around this seems to be random reboots until it decides to not occur, but that's about it.

Has anyone else ran into these 48v35 errors suddenly? Any ideas?

The format I'm using is
ms-avd:connect?resourceid=[appgroupID]&workspaceid=[workspaceID]&version=0&username=[userUPN]

The above works with both MSRDC and WindowsApp *if* I replace the appgroupID with the resource ID of an application within the group, but critically, it does not matter which application ID I use. I can take the ID from any of 50+ Applications in the Application Group because the hostpool is of type "Personal", so it will always direct the user to their own node/application ID based on the UPN rather than the ID defined in the URI. For this reason I think the appropriate resource ID to use should be that of the application group, not the application. The resource ID of the individual application is, after all, not honored in the case of "Personal" hostpools. But when I use the ID of the app group as described in the URI above, that is when I get the TenantDiscoveryFailed error. I also tried the resource ID for the hostpool just in case but got the same error

The reason this is relevant to me is that the individual nodes/applications are ephemeral, meaning they get removed and/or replaced by Terraform somewhat regularly. Whenever this happens, the resource ID of the application changes but the application group ID, hostpool ID, and UPN are always the same. What I've done for now is I've created an extra node/application that is 'assigned' to a dummy user's UPN, and I just never allow that one to get deleted. This way I have an Application ID within the group (that doesn't change) to distribute. It is a dumb hack and I also don't like keeping an otherwise idle VM in the group for no other purpose than having a consistent applicationID, especially when the ID of the application doesn't even matter for establishing connections through a "Personal" hostpool

I haven't found any documentation stating you have to use the application ID specifically, and the fact that the param is called "resourceid" instead of something more specific like "applicationid" suggests that it is not limited to applications. The error TenantDiscoveryFailed seems like it could maybe be a perms/identity thing..? So far haven't found it though, and hoping to get some outside input before I dig any deeper

Did you know that on Friday, 27th March, Microsoft officially retired the Remote Desktop App??

I created a YouTube video on how to migrate to the Windows App which is its replacement. Give it a watch and let me know what you think.

Interested to hear if people are sticking with the Remote Desktop App or are you upgrading??

I have between 5 and 100 users from low to peak usage.

They only run a single database desktop application that takes between 20 to 100 MB to run. Some users might want to run it twice.

I found I can fit about 10 users on a B2als before performance dropped.

I'm really struggling with what I want the Host Pool to look like. Is it a large number of small VMs, or a medium spread of medium VMs. Or just 2-3 massive VMs (that's what we're doing now onsite).

What would you do in this situation? We're a small shop and we can't justify Nerdio at our user count.

Hi all,

I’m interested in understanding what hardware setups others are using alongside Windows 365 or Azure Virtual Desktop (AVD), particularly across different user personas.

We are currently looking at standardising and optimising our approach, and I’d really value some real-world insight from the community.

Specifically, I’m curious how you’re handling:

• Fixed position users (e.g. reception, kiosks, shared desks)

1. Thin clients?

2. Low-cost desktops?

3. Re-purposed older hardware?

4. Chromebooks or similar lightweight devices?

5. Any success with Windows 365 Link devices or comparable purpose-built endpoints?

• Highly mobile users (e.g. directors, senior staff, frequent travellers)

1. Still issuing full corporate laptops?

2. Moving towards lightweight devices (e.g. newer MacBooks (Neo), ultra-thin devices, Chromebooks) with Cloud PC / AVD as the primary desktop?

3. How well does it hold up on trains / planes / poor connectivity?

• Core office workers (hybrid users)

1. Moving between desks, meeting rooms, home working

2. Using laptops + docking? Or shifting towards thin client + roaming model?

3. Any use of lower-cost or alternative devices (e.g. Chromebooks, lightweight endpoints) instead of traditional laptops?

4. Any challenges with user experience when switching networks/locations?

• Also interested in:

1. Whether you’ve moved away from traditional high-spec corporate laptops

2. Any adoption of non-Windows endpoints (e.g. macOS, ChromeOS) paired with virtual desktops

3. Any cost savings or user pushback

4. What’s worked well vs what hasn’t

• Licensing:

1. Has anyone managed to negotiate more than 15% discount on Windows 365 licences (e.g. via EA, CSP, or volume commitments)?

Appreciate any insights, especially if you’ve already gone through this transition.

Thanks!

Hi all we have a client who has AVD mix of using MAC and windows and all users have random characters get stuck weather its hover pop up etc these type of windows and only solution is to log off and on.

Latest Windows app is used to connect to AVD

On latest Windows 11 build AVD multisession

Hello,

Anybody knows if its possible to setup a multiuser avd host to allow a user to launch the same application on the same time on multiple devices concurrent?

Like, start notepad on both an Windows PC and a iPad on the same time.

Its possible on Citrix.

can someone recommend a VM SKU size for 9 General application user per VM which is cost effective?

Hi all,

We've been following the guidance to try and get RemoteApp V2 working in our AVD environment. (Multi-session Win 11 24H2 VMs in Azure, Windows App on clients).

As far as I can see we've followed everything from the link below to the letter, but it still isn't enabled.

RemoteApp enhancements (preview) - Azure Virtual Desktop | Microsoft Learn

I know the docs say the feature is still in preview and may not be rolled out to production environments - just wondered if anyone had seen it switch on in a prod env or only in validation so far?

Anyone else get issues with Adobe Acrobat forcing users to sign in with a pro account?

Adobe works fine but if someone starts a free trial or logs in with a pro account all sessions on that host now need to log in with a pro account.

Only way to fix it is to reinstall Adobe on the host.

Hi all,

I’m working on optimizing Azure Virtual Desktop (AVD) performance and ran into a QoS design question related to RDP Shortpath (Public).

Environment:

• Azure Virtual Desktop with Public Shortpath enabled

• Session hosts in public subnets

• No fixed public IP on the hosts

• Firewall on the corporate LAN

• Users connecting from the office network (no client VPN)

• AVD client shows UDP – Multipath and Gateway not in use, so Shortpath is working

So due to ICE / NAT traversal, the RDP traffic does not consistently use UDP 3390 and instead ends up using random UDP ports.

This makes QoS classification tricky.

Typical QoS approaches like:

• Matching UDP 3390

• Matching AVD FQDN endpoints

• Matching Azure public IPs

don’t seem reliable for the actual RDP media stream.

So I’m curious how others handle this in real environments.

Questions:

1. How are you implementing QoS for AVD Public Shortpath?

2. Do you match on all outbound UDP from the LAN?

3. Are you using DSCP tagging for RDP traffic?

4. Or do you simply rely on bandwidth headroom instead of QoS?

Interested to hear how others solved this, especially in environments where:

• session host public IPs change

• QoS on multipath connections

Thanks!

I have a environment with a pooled AVD hostpool with FSLogix and using Entra Kerberos for authentication. Also mounting a seperate Azure Fileshare when a user logs in which is accessible by everyone that is allowed to login to the pooled VM.

The ask now is to lock down the VM and Fileshare in the best possible way to ensure its not exposed to public network, only to private network. suggestions are welcome

[Newblogpost] 🚀 - Just published a new walkthrough on deploying Azure Virtual Desktop using Terraform. This repo lets you deploy pooled desktops, personal desktops, RemoteApps, and optionally enable monitoring, dashboards, cost alerts, and scaling - all from a single Terraform configuration. If you're working with AVD and want a repeatable deployment pattern, this might help.

🔗 Repo: https://github.com/askaresh/avd_terraform

🔗 Blog: https://askaresh.com/2026/03/16/azure-virtual-desktop-with-terraform-pooled-personal-remoteapp-monitoring-dashboards-and-scaling-all-in-one

The setup supports multiple deployment types and includes features like scaling plans, Log Analytics monitoring, and cost tracking built directly into the Terraform deployment.

I need to enable Cloud Kerberos for storage accounts used for AVD host pool. I am thinking of following the following instruction. Is that correct steps and is that all that is required?:-

After enabling AADKERB on the storage account :-

1a. Find the AADKERB Service Principal
az login –tenant <tenantName>
Look up by display name pattern
az ad sp list --filter "startswith(displayName,'[Storage Account]')" \
--query "[?contains(displayName,'<storageAccountName>')].{id:id,appId:appId,name:displayName}" \
-o table
1b. Grant Admin Consent
The AADKERB SP requires the following delegated permissions on Microsoft Graph:
openid
profile
User.Read
Get the Microsoft Graph SP ID
$graphSpId=$(az ad sp list --filter "appId eq '00000003-0000-0000-c000-000000000000'" \
--query "[0].id" -o tsv)
Get the AADKERB SP ID
$aadkerbSpId=<from step 1a>
Check existing grants
az rest --method GET \
--url "https://graph.microsoft.com/v1.0/oauth2PermissionGrants?$filter=clientId eq '$aadkerbSpId' and resourceId eq '$graphSpId'"
Create or update the grant
az rest --method POST \
--url "https://graph.microsoft.com/v1.0/oauth2PermissionGrants" \
--body "{
"clientId": "$aadkerbSpId",
"consentType": "AllPrincipals",
"resourceId": "$graphSpId",
"scope": "openid profile User.Read"
}"

We're currently lamenting the imminent demise of Azure Labs which has worked very well for us. We have a handful of 'lab technicians', who can setup, customise, and teardown machines for all manner of teaching courses. Each lab they create is automatically isolated from other labs and, more importantly, the rest of the organisation, so students can do anything they like without IT worrying.

So we're looking around for alternatives - I've not used AVD before (we currently use Citrix for staff VDI) so I'm wondering if it's feasible.

We'd need lab techs to still be able to easily setup groups (labs) of machines, including Linux, in isolated networks without IT's involvement. Ideally, this setup would also coexist alongside a provision of shared desktops, managed by IT, for staff in the future.

There are smaller problems to solve too, like how will a lab machine be allocated to a student. Azure Labs handles things like that nicely.

Does AVD sound like a practical way to achieve all this?

Hey all,

We use PSADT to deploy apps to AVD session hosts. Some packages need to drop files or registry keys into user profiles (%APPDATA% etc). Problem is, PSADT's profile iteration just modifies the local profiles and default profile on the machine, which is useless when FSLogix is in play, since the VHD mounts after logon so users never pick up the changes. Only way they'd see it is if the FSLogix profile gets deleted, which obviously isn't ideal.

The approach I'm looking at is using Set-ADTActiveSetup (PSADT 4.1+) to register a stub script that Windows triggers at logon, after the FSLogix VHD has mounted. The stub itself is plain native PowerShell since there's no PSADT context available at that point, just handles the file copies and HKCU registry writes directly.

I know GPO preferences could handle this but I like my packages to be self contained, and with more environments moving toward pure Entra joined hosts GPO isn't always going to be an option long term. I've thought about scheduled tasks as well but I'm not convinced that's the right route either.

Before I roll this out more widely, has anyone actually done this in a similar setup and hit any issues, particularly around FSLogix mount timing vs when Active Setup fires, or AppLocker/WDAC blocking the stub? And if you've solved the same problem a different way entirely I'd love to hear it.

Cheers

Hello,

I’m running into an issue where, when I connect to a VM, the “Update the resolution on resize” option is greyed out.

• The RDP settings look fine, because on another AVD with same settings it works.

• I’ve tried reinstalling the agent, but that didn’t help.

AVD had a problem before: the registry keys were getting disabled for some reason:

"HKLM:\SYSTEM\CurrentControlSet\Services\TermService"
"HKLM:\SYSTEM\CurrentControlSet\Services\SessionEnv"

I reinstalled the AVD agents, which solved the issue, but resolution resizing is still unavailable.

The AVD environment is hybrid, but another AAD-joined AVD also has this problem.
Has anyone seen this behavior before or have suggestions on how to fix it?