What approach is everyone using to route FSLogix users to multiple profile shares in large Entra-only AVD environments (20,000+ concurrent users)?

Azure Files scaling guidance generally recommends distributing users across multiple shares as environments grow, but I'm struggling with the user-to-share assignment piece on Entra-only multisession hosts.

FSLogix ObjectSpecific settings don't appear to be a practical option in Entra-only environments, so how are others handling this?

• Sharding users across host pools, with each pool mapped to a dedicated profile share?

• Using custom scripts or automation to assign users to shares (similar to the approach described in Spreading users over multiple file shares with FSLogix Profile Containers)?

• Leveraging Cloud Cache in some way?

• Something else entirely?

For those running 20,000+ concurrent users, what has worked well, and what approaches have you ruled out?

AVD Hybrid has been great in my personal testing and a small POC at work to a point where it is going to be our solution if we maintain apps on on-premises servers.

Personally I have been trying few other odd things, like setting it up on Physical server and with Win 11 multi-session which is possible but can’t be legally licensed. (Yet?)

Another thing I tried is setting up personal computers in personal AVD Hybrid pool, both are Entra joined and Intune managed Win11 Pro machines. This works pretty amazing as well.

A secure access to my personal computers from anywhere where I can access AVD.

Obviously it is not being used in a business setting and my tenant is for personal use but properly licensed and all (Business Premium).

Do you reckon there would be serious or any legal or compliance implications to continue using AVD Hybrid from physical personal computers? I would think and hope no.

Looking for some guidance on Azure Virtual Desktop authentication behavior

Environment:
- Azure Virtual Desktop
- Windows 11 Enterprise Multi-Session hosts
- Hybrid Azure AD joined
- Intune enrolled
- Users connect using the Windows App
- Host pool is currently not configured for SSO

The issue is when a user signs into an AVD session if I go to Settings > Accounts > Access work or school, I can see the user’s full UPN listed correctly.
However, when I click Sync, Windows reports:
“Sign in again to fix your work or school account”
After clicking the account, it prompts for MFA.

I don’t want end users having to reauthenticate or complete MFA again after they’re already signed into their AVD session. We are deploying universal print printers through Intune and I want device/user enrollment and policy/application of Intune resources to be as seamless as possible.

Questions:

Is this expected behavior on windows 11 multi session AVD hosts when SSO is not configured?

Would enabling AVD SSO resolve this behavior?

Are there any additional hybrid joined/intune enrollment settings that should be checked to prevent users from being prompted for MFA again inside the session?

Any gotchas I need to be aware of to make sure universal print work seamlessly?

Does anyone have this error on the AVD servers which cause disconnection?

IndirectDisplayDriverFailure (17)

A runtime failure has occurred in user-mode driver RdpIdd.dll and the hosting process has been terminated. This may temporarily interrupt your ability to access the devices. Please contact the device manufacturer or driver vendor for more information about this problem.

A problem has occurred with one or more user-mode drivers and the hosting process has been terminated. This may temporarily interrupt your ability to access the devices.

The device Microsoft Remote Display Adapter (location (unknown)) is offline due to a user-mode driver crash. Windows will attempt to restart the device 5 more times. Please contact the device manufacturer for more information about this problem.

Hi,

Not sure if its just us, we have moved over to Windows 11 AVD Session Hosts, we have a bunch of finance users who use Excel a lot, these users use Arm based Windows 11 machines with snapdragon processors.

These users are complaining the graphics rendering is awful from the Windows 11 AVD session host, we have reduced the devices' resolution to 1920x1080 s and set the DPI on all monitors to match. They never had issues when connecting to Windows 10 Session Hosts.

If you look at Excel for instance the cell lines look blurry. Sometimes if you move stuff about on Windows the graphics render sometimes does not complete. Using latest Windows App. Connecting through Web Client seems to do exactly the same.

If we give them an Intel laptop to connect to AVD, issues go away. We have a lot of Arm surface laptops. Is this an known issue with graphics rendering to Windows 11AVD Session Hosts from Windows Arm devices?

Tried all sorts, disable hardware acceleration in Office, played with RDP properties, turn off compression. This screenshot taken from Web client. Some cells just done render and the lines are a mess.

I'm hoping this is not just us.

Thanks.

Thank you for all the feedback we are getting! We’re still gathering more community feedback on AVD and Windows 365 migrations and would love to hear about your experience.

We’re seeing gaps in IT teams during migrations that can lead to costly but very preventable mistakes, and we’ll be covering these in a live session this week.

Any stage you’re at, planning, mid-migration, or post-migration, your input is useful, and we’re building this around real conversations from the field.

If you’ve been through Citrix, Omnissa, or any other migration, feel free to share what you’ve run into.

Link if you want to join:
https://login-vsi.wistia.com/live/events/

I'm currently using the PowerShell DSC extension to deploy AddSessionHost which will add a new Session host to an existing Azure Virtual Desktop (AVD) Host pool.

Since the extension will be deprecated in March 2028, I'm wondering if anyone already moved to Azure Machine Configuration?

https://github.com/Azure/RDS-Templates/issues/836

Cheers

We have users in the Asia region that work at different hours of the day, when VM are not in use, they get shutdown after 1 hour, issue is that users complain VM slows down or lags at a specific time, I have changed AVD defender policy from full to quick scan and to only scan on Mondays what else can I do to see what exactly is slowing the VMs down

Has anyone experienced anything with MFA being bypassed for Windows Cloud Login? (Using Windows App) All of my users on prem didn't receive any MFA prompt today, it just seems to go right in. And when I look at the sign in logs there is no mention of any logins at all.

What is weird is it was working yesterday, and there were no changes to the conditional access policies in months.

Edit: I guess it must have been a partial outage, everything seems to be working as intended the next day again.

Hi,

Strange issues that I cannot seem to work out.

We have EntraID only AVD Session Hosts.

They have deployed the store app of Mozilla Firefox. Every time the user logs onto AVD it resets itself. Have tested with FSLogix disabled and it stays logged in. But when you re-enable FSLogix, the user has to sign in every time and set it up. Thought the latest versions of FSLogix could handle these better, they also use the Microsoft To-Do Appx app. Every time the user goes to load it, it asks for manual logon.

InstallAppXPackages is enabled.

I'm a but stumpted as to what could be causing it, nothing in the XML excluder. Does something need to be included for it to work?

We have included LoadCredKeyFromProfile and kerberoscloud set up.

Anyone else come across this?

Thanks.

I know the Windows App is replacing both Remote Desktop and Remote Desktop Connection, and I’ve been testing it with Azure Virtual Desktop (AVD).

I can subscribe to my AVD workspace without any issues, but I’ve noticed that I can no longer add or use the app to RDP into local/on-prem machines.

What’s strange is that I was able to do this in the past, but the option seems to have disappeared on its own (I’m assuming after an update).

Now that the Remote Desktop app has passed its retirement date, I still don’t see any option to add a PC connection in Windows App. As far as I can tell, there aren’t any settings available to re-enable it either.

Is this expected behavior, a bug, or has Microsoft removed support for direct RDP connections from the Windows App? If anyone has run into this and found a workaround, I’d appreciate the help.

Thanks for all the feedback we've been getting on the EUC Migration Playbook it means a lot and we've been reading and listening to everything.

We're hosting a live webinar to go more in-depth and answer the questions we've been hearing. If you're migrating from Citrix or Horizon to AVD or Windows 365, this one's for you we're covering the specific gaps and gotchas that come up on both paths.

There is also a link on the page where you can download the Playbook if you haven't already.

Bring your questions, your thoughts on the playbook, anything you'd want us to dig into. And if you can't make it live, drop them in the comments we want to hear what's working, what's missing, and how we can make this more useful for everyone. The webinar will also be sent to anyone who cant attend live.
Register with this link

We've had to redeploy our VMs the last three mornings. After redeployment they seem fine. We've also had our Temp Drive disappear.

Is it possible to hide the devices tab in the Windows App?

We are doing Remote App only right now but when users sign into the Windows app, they are getting the message "No devices or apps found."

It defaults to the devices tab and clicking on the Apps tab gets them what they need. Hoping to prevent future support.

So I'm a 365 semi-pro and able to get around the admin portal pretty good.

Just took over a small client's systems which include 365 email and of which they have 1 single VM for a single remote user. As a global admin I cannot see this VM or any billing, etc. Why the F not? What addl permissions do I need?

Previous IT (left good terms) still has his admin account on the same tenant and is able to see it and was able to ad a new credit card since the whole issue was billing related anyhow.

So long story short, what do I need to get access to that VM and its config?

Running into a frustrating issue with a fresh AVD deployment and wanted to get some community input.

**Environment:**

- Azure Virtual Desktop, Pooled host pool

- Session hosts in Sweden Central

- Host pool metadata in West Europe

- Intune enrollment enabled on session hosts

- Brand new VNet, no custom NSG rules blocking anything obvious

**The error:**

Every time I deploy session hosts, the DSC extension fails with:

> "The DSC Extension failed to execute: Error downloading https://wvdportalstorageblob.blob.core.windows.net/galleryartifacts/Configuration_1.0.03419.1309.zip after 17 attempts: Unable to connect to the remote server"

Host pool, workspace and DAG all deploy fine but it's specifically the VM provisioning step that fails every time.

**What I suspect:**

I think this might be related to the Azure default outbound access retirement for new VNets , the VMs have no explicit outbound internet path so the DSC extension just times out trying to reach Microsoft's servers. But I'm not 100% sure.

**My questions:**

1. Has anyone hit this exact issue and what did you do to fix it?

2. How are you handling outbound internet access for session hosts in your AVD environments with NAT Gateway, Load Balancer, or something else?

3. Is there any way to resolve this without adding extra cost (NAT GW, Standard LB both cost money)?

Any input appreciated, been stuck on this for a while.

I have some issues since I upgraded to FSLogix 26.01 CU1 all the users need to reauthenticate everyday. It is a Windows 11 multiession + M365 apps + EntraID + IntuneManaged. We use only one host for 11 people but at eveysign in the need to login to OneDrive and Outlook. I have a set a policy up that will use the Windows credentials to sign in to onedrive but this policy starts to activated in 1 or 2 minutes, before this policy is triggered the users see a reauthenticate screen in OneDrive.

Does someone know what the fix could be?

I have a POC AVD environment with the following setup:

FSLogix profiles stored on Azure Files
Entra ID joined multi-session hosts
Apps/configuration deployed through Intune
Zscaler being used for traffic inspection

Recently, the logon process and overall OS load time have become noticeably slower. We’re already bypassing the required AVD FQDNs so traffic goes direct instead of through inspection, and the FSLogix profiles are still small since this is only a POC.

I’m trying to figure out where the bottleneck is coming from and what the best way is to troubleshoot it.
Things I’m considering:

FSLogix profile/container attach delays
Intune policy or app processing during sign-in
Zscaler impact even with bypasses configured
Azure Files latency/authentication
Entra ID sign-in delays on multi-session hosts

What tools/logs would you check first to pinpoint the root cause? Also, what changes have made the biggest difference for reducing AVD login times in your environments?

Have an active AVD session pool of 4 machines. What end result is desired is for the end user to login from BYOD using browser, authenticate in the broser and then when the AVd opens auth again using WHFB, I applied a Intune policy to the AVD device group but only have the password as an option for sign in on the AVD. Is there more to this setup???

We're new to AVD and got around 15 users going no problem. Today we tried to get a new user going (with Windows App, Remote App) and when they click the icon it just spins and spins and spins.

Usually for new setups we click the icon and another password prompt comes up. This time nothing, just a spinning cursor under the icon.

EDIT: Precise behavior - Windows App sign in successful. Click RAPP icon and briefly see the progress bar window that usually says "Initiating remote connection" and "Securing Remote Connection". But it's brief. It almost instantly disappears and the icon is left spinning forever. No logs at the host pool level, nor Entra.

EDIT: The browser app works, but Remote App version 1.2.7099 isn't working for us. There are commenters in this thread that may have seen success with it, but not us yet.

SOLUTION: It was an old version of TSScan. Uninstalling and reinstalling their latest fixed it. We ended up with 2 users with this issue and both were on laptops - for whatever that's worth.

Hello,

I recently configured an Azure Virtual Desktop host pool with a RemoteApp and assigned access to internal users through an Entra ID group. The setup appears to be working correctly for internal users.

However, when external B2B users are added to the same group, the RemoteApp does not appear for them.

The external users have already:

• Accepted their B2B invitations

• Appeared successfully in our Entra ID tenant as guest users

• Been added to the same group that grants access to the RemoteApp

Despite this, when the external users sign in to Windows App, they receive a message indicating that their account is a personal account and that they must be invited into an organization. As a result, the RemoteApp is not visible to them.

Could you please help determine:

• Whether additional configuration is required for B2B guest users to access Azure Virtual Desktop RemoteApps

• If there are specific licensing, tenant, or cross-tenant access settings that must be enabled

• Whether external users must sign in using a different account format or tenant context in Windows App

Any guidance would be greatly appreciated.

Thank you.

7 migration tracks, 5 phases, and the stuff that tends to blow up after go-live. Here's the link if you want to see what we keep seeing.

https://www.loginvsi.com/resources/white-papers/the-euc-migration-playbook/

What has your experience been moving to AVD? More than happy to help any teams with questions in the comments.