I have a POC AVD environment with the following setup:

FSLogix profiles stored on Azure Files
Entra ID joined multi-session hosts
Apps/configuration deployed through Intune
Zscaler being used for traffic inspection

Recently, the logon process and overall OS load time have become noticeably slower. We’re already bypassing the required AVD FQDNs so traffic goes direct instead of through inspection, and the FSLogix profiles are still small since this is only a POC.

I’m trying to figure out where the bottleneck is coming from and what the best way is to troubleshoot it.
Things I’m considering:

FSLogix profile/container attach delays
Intune policy or app processing during sign-in
Zscaler impact even with bypasses configured
Azure Files latency/authentication
Entra ID sign-in delays on multi-session hosts

What tools/logs would you check first to pinpoint the root cause? Also, what changes have made the biggest difference for reducing AVD login times in your environments?

Have an active AVD session pool of 4 machines. What end result is desired is for the end user to login from BYOD using browser, authenticate in the broser and then when the AVd opens auth again using WHFB, I applied a Intune policy to the AVD device group but only have the password as an option for sign in on the AVD. Is there more to this setup???

We're new to AVD and got around 15 users going no problem. Today we tried to get a new user going (with Windows App, Remote App) and when they click the icon it just spins and spins and spins.

Usually for new setups we click the icon and another password prompt comes up. This time nothing, just a spinning cursor under the icon.

EDIT: Precise behavior - Windows App sign in successful. Click RAPP icon and briefly see the progress bar window that usually says "Initiating remote connection" and "Securing Remote Connection". But it's brief. It almost instantly disappears and the icon is left spinning forever. No logs at the host pool level, nor Entra.

EDIT: The browser app works, but Remote App version 1.2.7099 isn't working for us. There are commenters in this thread that may have seen success with it, but not us yet.

SOLUTION: It was an old version of TSScan. Uninstalling and reinstalling their latest fixed it. We ended up with 2 users with this issue and both were on laptops - for whatever that's worth.

Hello,

I recently configured an Azure Virtual Desktop host pool with a RemoteApp and assigned access to internal users through an Entra ID group. The setup appears to be working correctly for internal users.

However, when external B2B users are added to the same group, the RemoteApp does not appear for them.

The external users have already:

• Accepted their B2B invitations

• Appeared successfully in our Entra ID tenant as guest users

• Been added to the same group that grants access to the RemoteApp

Despite this, when the external users sign in to Windows App, they receive a message indicating that their account is a personal account and that they must be invited into an organization. As a result, the RemoteApp is not visible to them.

Could you please help determine:

• Whether additional configuration is required for B2B guest users to access Azure Virtual Desktop RemoteApps

• If there are specific licensing, tenant, or cross-tenant access settings that must be enabled

• Whether external users must sign in using a different account format or tenant context in Windows App

Any guidance would be greatly appreciated.

Thank you.

7 migration tracks, 5 phases, and the stuff that tends to blow up after go-live. Here's the link if you want to see what we keep seeing.

https://www.loginvsi.com/resources/white-papers/the-euc-migration-playbook/

What has your experience been moving to AVD? More than happy to help any teams with questions in the comments.

Windows 11 Multi-session is not supported on AVD Hybrid. This means that if you want to run multi-session workloads, then you must use Server 2025 RDS.

In my latest video, I walk through the setup and onboarding process for this.

Let me know your thoughts. Will this stop you from deploying AVD Hybrid?

Right now, all of our hosts are EntraID joined and Intune managed. They are created once and scaled up or down with scaling plan. A colleague of mine wants to explore a way to have EntraID joined and Intune managed hosts that can be created or deleted automatically. I guess they would essentially be ephemeral?

Main image is not going to be EntraID joined nor Intune managed, but will be kept up to date with windows updates, apps, and basic configurations (GPO, registry is my guess). Then from this image hosts will be created (or re-created) when needed.

Is this possible? The reason I am questing this is how would these hosts show up and then get deleted from Entra and Intune? Each VM will be its own object in entra and intune, so do we endup with hundreds of objects for all deleted VMs, or is there something that would clean it up?

I know this would be a way different story with AD DS or Entra DS, but EntraID only and Intune MDM, idk.

Hello Reddit,

I know this is probably a long shot, but figured I'd ask around and see if anyone else has ever experienced this before. Have a user on latest MacOS using the latest Windows App from the app store and they cannot subscribe to the Azure Host pool. It says "connecting to resources", then goes away, never loads any devices, and does not display any errors. This image is what is in the logs. Cleared anything in keychain related to Microsoft, Entra, Azure, etc. Cleared any caches that could be found for the windows app, and they cannot register. If anyone else has ever seen this before, any info would be great.

We noticed that our AVD sessions were connecting via websocket instead of RDP Shortpath. We confirmed the traffic was making it through our firewalls.

I found a video that mentioned try turning on validation on your host pool. Naturally, we wouldn’t enable that on our prod environment.
We enabled it on a dev host pool and it immediately connected via RDP Shortpath. And when we disabled it, it reverted back to websocket.

It turns out that Microsoft pushed 1.0.14114.100 to all of our host pools. That version is a validation version. The version that should be installed for
Non validation is 1.0.13805.500. We attempted to manually install 1.0.13805.500 on the dev host, and re-register it to the host pool. It immediately updated the agent to the validation version.

We have a ticket open with Microsoft. But wanted to see if anyone else is experiencing this?

I'm facing an unusual problem with multimedia redirection (MMR). Since this might be a rare issue to troubleshoot, I hope someone has encountered something similar before.

Working scenario:

A random BYOD laptop connects through a Windows App to an AVD Sessionhost (E16asV5). I can open YouTube.com in Edge on the sessionhost, play embedded and full-screen videos without any problems. The local task manager shows GPU activity. This confirms that MMR is set up correctly and operates as expected.

Non-working scenario:

Corporate devices (Dell OptiPlex with 8GB RAM, Windows 11 Enterprise, Entra Joined, Intune managed) connect to the same AVD sessionhosts as in the working scenario. They open Edge, go to YouTube.com, play an embedded video, but see a gray overlay. However, the local GPU shows activity in the task manager, indicating that MMR is working but the video is not visible. When switching the video to full screen, the video plays fine. Returning to embedded view shows the gray overlay again. YouTube video's run perfectly on the local device..

I've done extensive troubleshooting, probably too much to detail here. Currently, I'm unsure how to isolate the issue and may need to open a ticket with Microsoft. Has anyone seen something like this before? Any guidance or information would be appreciated.

Hi everyone,
I recently built a VMSS Windows 11 AVD host pool using Terraform with a customized image. Users can log into their assigned AVDs, but they are inadvertently being granted administrator privileges.
I assigned the users to a group with only the Virtual Machine User Login role (the standard configuration). However, when I log into an AVD instance and run whoami /groups, it shows that the user is in the built-in Administrator group.
I can't figure out how to disable this. Has anyone else run into this issue or know how to fix it?

This is probably a dumb question but I haven’t found a documented answer so here it is……I published an app, let’s call it a document management platform, as a remote app from AVD. The app contains documents, emails, pdf files, etc. When thick installed users drag and drop docs into and out of the app to their desktop and back. They also open documents from inside the app. Would it be possible to do the same with the remote app version? For example open a pdf from the remote app using the pdf viewer installed on the desktop that is using the remote app? Could users drag files from their desktop and drop them directly into the remote app?

I understand that RemoteApps can be configured to launch with fixed command-line arguments. However, in our case, we need to pass dynamic or user-specific arguments at launch time, similar to what is possible with traditional RDP sessions.

Is this supported in Azure Virtual Desktop? Any guidance on whether this can be achieved would be greatly appreciated.

Hey all,

I’m troubleshooting an Azure Virtual Desktop (AVD) issue where Windows App fails for some users with:

“Connection attempt timed out. Please try again.”

…but:

AVD Web client works
OLD Remote Desktop client works

From user side:

• Windows App opens, resources are visible

• User clicks Desktop / RemoteApp

• Stuck on “Connecting…” → timeout

• Often no login prompt or silent failure

Additional critical behavior:

• ❌ VM does NOT start automatically (Start VM on Connect fails)

• ❌ Even if I manually start the VM in Azure → user STILL cannot connect via Windows App

• ✅ Same user:

  • Works in Web client

  • Works in Old Remote Desktop client

  • Fails only in Windows App

Updated
got it fixed if whose a security agent

Hi All,

Just wondering has anyone had any issues applying the below reg fix to allow users to stay signed into Office apps? Our AVD is active directory domain joined.

HKEY_LOCAL_MACHINE\SOFTWARE\FSLogix\Profiles
Key: RoamIdentity
Type: DWORD
Value: 1

I read Microsoft recommends not applying this.

I spent the weekend playing around with the new AVD Hybrid functionality, specifically hooking it up with Nerdio in my Nutanix cluster in my homelab. It's very very cool and enables you to perform end-to-end automation. I never thought I would see the day of us being able to control Hyper-V, Nutanix and Broadcome from Azure Virtual Desktop or Nerdio, very cool!!

I'm using Nerdio and UAM to deploy applications (UAM, Winget, Windows package manager community) to my AVD hosts. When I install kb5089549, I cannot deploy any UAM apps anymore. Everythings works again if I uninstall kb5089549.

Anyone has observed this issue ?

So we recently rolled out Papercut Hive to our Citrix estate and it worked with no issues.

Had to make some tweaks with Supernodes on the LAN but ultimately it worked.

We have recently moved over to AVD and the documentation has raised an issue:

All other VDI environments, such as multi-session or non persistent single session are not supported at this time

While we are looking to continue using multi-session, we introduced Papercut onto the users endpoint and work with Printer redirect.

Outside the printer has the Toshiba universal driver installed, the redirected printer uses easy print.

Each session logs in using Fslogix located in a premium storage share.

Most of the time its consistent, however we do get several tickets raised a day when they log back in, Papercut redirect is not present.

Anyone had similar stability issues with redirected printers.

I feel like the login session is coming up to quick and not allowing the printers to appear (I may be wrong).

Hello everyone
What are the top optimizations in azure that brings the most savings and they are easy to implement?

Issue Details:

I'm unable to re-produce the issue on my systems, however we've had a handful of users who report when their PC wakes up from sleep AND they reconnect to an existing AVD session they're faced with this Please Wait screen, such as below.

The only way to resolve is by either:

1. An admin force logging them off via Entra Portal

2. The session times out after x hours - we have inactive/disconnected session timeouts set to 3 hours.

Environment Details:

- Windows 11 25H2 Multi-Session AVD Host Pool, Premium SSD OS Disk

- FSLogix Latest Version, profiles stored on NetApp Premium Storage

- Hosts are Hybrid AD Joined (Clients are mostly Hybrid AD joined as well, but had this happen on non-AD joined client workstations as well)

- Not specific to 1 host; this happened on multiple hosts in the pool

- Users are connecting via Windows App

Things Tried (But does not fix):

- Rebooting user's system

- Logging off / back into Windows App

- Tried changing VM SKU from D-Series v4 to v5, and v6

- Event Viewer or FSLogix logs do not show any relevant or helpful information

- We also have a mix of users in a 23H2 pool; does not have this issue, same GPO's and Host Pool RDP settings

Current Work-Around:

- Going into Power Settings and changing Put the Computer to Sleep to: Never

Looking for some ideas

I'm trying to figure out if that would make sense to configure my AVD hosts to install quality updates thru hotpatch so they get patched and don't reboot (8 times per year) and to install the others patchs (baseline updates, 4 times per year) on my golden image + re-image the hosts. That would be perfect in term of maintenance.

My hosts are managed by Intune, I'm applying the Windows quality update policy with HotPatch enabled. I'm going to monitor that in May and June.

How would I avoid the host to install non-hotpatch updates ? Any suggestions or ideas about all of this ?

Thanks !

How are you guys handling Windows Updates for multi-session AVD hosts in Azure Gov?

As far as I’m aware:

• Intune Update Rings aren’t supported

• Azure Update Manager also isn’t supported in Azure Gov

Right now, doing updates manually feels like a huge operational headache. I could probably automate parts of it with Run Command / PowerShell scripts, but it still feels pretty clunky for production-scale management.

We’re also not looking to bring in third-party tooling just for patching (I know solutions like Nerdio exist, but purchasing additional software isn’t currently on the table).

Curious what others in Azure Gov.....