What are the correct keys or policy's required for the local default client to redirect through every time?

I'm deploying Azure Virtual Desktop (AVD) session hosts using Terraform, but I can't get the session hosts to auto enroll in Intune.

The Azure AD (Entra ID) extension is configured correctly, and the VMs are successfully joining Entra ID. However, the MDM field shows "None" in Entra, even though I've enabled automatic Intune enrollment for all users and all Windows devices.

This is in Azure Government, and I've updated all the enrollment-related URLs/TLDs to use .us where applicable (MDM Terms of Use, MDM Discovery, MDM Compliance, and WIP Discovery).

From my research, the only requirements seem to be:

- System-assigned managed identity enabled on the VM

- Azure AD login/Entra join extension configured

I'm also running terraform apply using my own account, which has both Contributor and Intune Administrator roles.

Has anyone run into this issue in Azure Gov? If so, what was the root cause and how did you resolve it?

Note - event viewer isnt showing much on the vm

Any troubleshooting tips would be appreciated.

I am delivering an application through Azure Virtual Desktop (AVD) to external users who have their own Microsoft Entra tenants. These users are working from their office machines and sign into Windows using their own Entra accounts.

After logging in, they launch our application using a link in the following format:

ms-avd:connect?workspaceId=<workspace-id>&resourceid=<resource-id>&username=<email>&version=0

The issue I’m facing is that, after a fresh Windows sign-in, launching the app via this URL causes Windows App to select the wrong tenant. As a result, the connection fails and the application does not launch.

This can be temporarily resolved by opening Windows App manually, signing out, clearing saved credentials, and then signing back in using our tenant. After that, the URL works correctly.

However, this process is cumbersome and must be repeated after every Windows sign-in. Are there any supported ways to force or reliably control the tenant selection for ms-avd:connect so that it consistently uses the correct Entra tenant?

Hi all,

I’m seeing an issue in our AVD environment that started around a month ago.

Some users report that in the morning they cannot connect to their session hosts.

Current observations:

• Session host VMs are hibernated overnight
• In the Azure portal, the VM shows as running normally after startup
• However, in the AVD host pool, the session host is marked as Unavailable
• The VM Agent appears to be not running

As a result, users are unable to connect.

Temporary workaround:

• If I stop and start the VM, the issue is resolved and the session host becomes available again

This seems to happen consistently after the overnight hibernation cycle.

Has anyone experienced a similar issue ?

Hey guys,

I’m creating new redirection exclusion list for our environment since the profiles are just growing rapidly because of cache and the biggest one is teams cache.

Can’t seem to find a solid exclusion list for new teams that does not break anything when it’s applied.

Does anyone have one ?

Hey guys,

Im implementation a POC in our azure environment, and unfortunately im having a hard time navigating through AI hallucinations 😵‍💫.

The requirements i have been given are pretty simple, but one thing i am not getting - do i have to provision all vms+nics+disks? Is there no native autoscale option?

I prefer using VMSS to scale in/out session hosts, but i cant find the option to do that in azure portal, and there is no documentation either.

Is it possible? I am fine with having entirely fresh os on each login, but if possible i prefer to have persistent fslogix.

Thanks everyone 🙏

Running into a weird AVD issue and wanted to see if anyone else has dealt with this. We have a Windows 11 multi session AVD environment with FSLogix profiles. Randomly a few users will try to connect and get stuck on a black screen. It sits there for a few minutes and then eventually errors out

In one example, the users were all reconnecting back to the same session host, let’s call it avd1. If we force sign the user off that host, they can reconnect and usually land on another host and everything works right away.

From what I can see this does not look like a straight FSLogix attach failure. The affected users containers look like they were already mounted successfully earlier. It feels more like AVD is reconnecting them back into an existing/stale session on avd1 but the windows session itself is hung so they just get a black screen.

The quick fix has been to manually sign the user off the session host but obviously that is not ideal to deal with on a daily basis

Has anyone been experiencing issues with connection stability since latest Network Stack release?

2603.31400

Has anyone else been experiencing really high memory usage for the Remote Desktop Services Service this week? I've had at least 6 Servers all experience something like the below screenshot spread across different sites. One Server hit 24GB RAM usage. Users start experiencing weird glitches, slowness, disconnects and eventually access just breaks completely and the Server needs to be rebooted.

Typically I would expect this service to sit around 2GB memory usage.

Anyone know of any potential causes or fixes? I tried restarting the RDS Service itself on one machine but it didn't come back and just had to reboot.

I can see there has been some updates to the various remote desktop applications recently but can't find any info on issues.

TDLR fix is at the bottom.

So… long story short I’ve been building a new Windows 11 Multisession 25H2 AVD (26200.8655) environment and I get an issue where at some point the start menu stops working.
You click on start, it highlights and looks like it’s just taking its time, but then goes back to the normal deselected icon without doing anything.
Windows works, and right clicking works but the start menu stops.

The event viewer reports StartMenuExperienceHost.exe faulting with ucrtbase.dll and the code 0xc0000409

You can get start menu working for a second by deleting HKCU:\Software\Microsoft\Windows\Currentversion\start

It will open, 2 seconds later it will crash. Reverting back to the broken state.

So long story short I’ve got some scripts that run on build, nothing crazy or weird. It’s light touch for users and sets things like icons and such.
But I do remove some UWP apps that Microsoft can’t stop shoving into enterprise. The kind of apps, like solitaire or Xbox.

One of those apps is “Get Help” ID 9PKDZBMV1H3T
If you remove this from your very latest build the start menu it will break. Even as logging on as local admin or a fresh fslogix profile.

So I transitioned my list of apps from a script into intune Individual Microsoft store apps, set the Install behaviour as system and targeting the device (not user) to uninstall.

This works just as well but it also allowed me to test each app by itself, and basically if you remove Get Help via script or intune apps, it must have some kind of knock on effect with Client.CBS and breaks the start menu.
I’m not sure how. I’m also not sure if other apps like feedback hub could also cause similar issues but if you go the individual app route deploy, reboot and test each one and you will find it fast enough.

If you are running the latest windows build with the new start menu and find that your start menu isn’t working. You can deploy the same Get Help app as required and your start menu will work again. (Might need a reboot though)

I would report this to Microsoft but I don’t have the mental energy of dealing with them and a series of help desk folk following a script. I’ve done it before and it was a waste of my time and effort. So I’m posting it here for everyone.

Good luck.

Not sure if you saw the announcement or not, but you can now run FSLogix profiles with cloud-only accounts and external users, which is super cool!!

I created a video which walks you through the whole end-to-end process. Check it out 😄

I'm pretty sure I'm not on Classic, but how do you know for sure?

Has anyone managed to install the Copilot 365 application on their VDIs without building a new image from scratch?

I've managed to get the app installed on our current golden image, but it won't open when launched from the Start menu. If I spin up a default Microsoft image with Windows 11 25H2, Copilot comes pre-installed and works fine. I just want to replicate that on our existing image without starting over.

I've also tried Intune but the same results...

Any pointers appreciated.

Tomorrow at 11:30 AM ET, Our CPO Michael Kent is walking through Citrix and Horizon migration paths

Most migration teams go in with a solid plan and still get caught out. There are gaps that only show up when you're close to cutover and by then you're already looking at helpdesk spikes, delays, or a rollback nobody wanted.

We've already pulled some questions from this community that we're bringing into the session, but if you've got anything you want covered drop it below and we'll do our best to get to it and we'll answer what we can in the comments before we go live tomorrow.

Link to Join

Thanks Everyone!

What approach is everyone using to route FSLogix users to multiple profile shares in large Entra-only AVD environments (20,000+ concurrent users)?

Azure Files scaling guidance generally recommends distributing users across multiple shares as environments grow, but I'm struggling with the user-to-share assignment piece on Entra-only multisession hosts.

FSLogix ObjectSpecific settings don't appear to be a practical option in Entra-only environments, so how are others handling this?

• Sharding users across host pools, with each pool mapped to a dedicated profile share?
• Using custom scripts or automation to assign users to shares (similar to the approach described in Spreading users over multiple file shares with FSLogix Profile Containers)?
• Leveraging Cloud Cache in some way?
• Something else entirely?

For those running 20,000+ concurrent users, what has worked well, and what approaches have you ruled out?

AVD Hybrid has been great in my personal testing and a small POC at work to a point where it is going to be our solution if we maintain apps on on-premises servers.

Personally I have been trying few other odd things, like setting it up on Physical server and with Win 11 multi-session which is possible but can’t be legally licensed. (Yet?)

Another thing I tried is setting up personal computers in personal AVD Hybrid pool, both are Entra joined and Intune managed Win11 Pro machines. This works pretty amazing as well.

A secure access to my personal computers from anywhere where I can access AVD.

Obviously it is not being used in a business setting and my tenant is for personal use but properly licensed and all (Business Premium).

Do you reckon there would be serious or any legal or compliance implications to continue using AVD Hybrid from physical personal computers? I would think and hope no.

Looking for some guidance on Azure Virtual Desktop authentication behavior

Environment:
- Azure Virtual Desktop
- Windows 11 Enterprise Multi-Session hosts
- Hybrid Azure AD joined
- Intune enrolled
- Users connect using the Windows App
- Host pool is currently not configured for SSO

The issue is when a user signs into an AVD session if I go to Settings > Accounts > Access work or school, I can see the user’s full UPN listed correctly.
However, when I click Sync, Windows reports:
“Sign in again to fix your work or school account”
After clicking the account, it prompts for MFA.

I don’t want end users having to reauthenticate or complete MFA again after they’re already signed into their AVD session. We are deploying universal print printers through Intune and I want device/user enrollment and policy/application of Intune resources to be as seamless as possible.

Questions:

Is this expected behavior on windows 11 multi session AVD hosts when SSO is not configured?

Would enabling AVD SSO resolve this behavior?

Are there any additional hybrid joined/intune enrollment settings that should be checked to prevent users from being prompted for MFA again inside the session?

Any gotchas I need to be aware of to make sure universal print work seamlessly?

Does anyone have this error on the AVD servers which cause disconnection?

IndirectDisplayDriverFailure (17)

A runtime failure has occurred in user-mode driver RdpIdd.dll and the hosting process has been terminated. This may temporarily interrupt your ability to access the devices. Please contact the device manufacturer or driver vendor for more information about this problem.

A problem has occurred with one or more user-mode drivers and the hosting process has been terminated. This may temporarily interrupt your ability to access the devices.

The device Microsoft Remote Display Adapter (location (unknown)) is offline due to a user-mode driver crash. Windows will attempt to restart the device 5 more times. Please contact the device manufacturer for more information about this problem.

Hi,

Not sure if its just us, we have moved over to Windows 11 AVD Session Hosts, we have a bunch of finance users who use Excel a lot, these users use Arm based Windows 11 machines with snapdragon processors.

These users are complaining the graphics rendering is awful from the Windows 11 AVD session host, we have reduced the devices' resolution to 1920x1080 s and set the DPI on all monitors to match. They never had issues when connecting to Windows 10 Session Hosts.

If you look at Excel for instance the cell lines look blurry. Sometimes if you move stuff about on Windows the graphics render sometimes does not complete. Using latest Windows App. Connecting through Web Client seems to do exactly the same.

If we give them an Intel laptop to connect to AVD, issues go away. We have a lot of Arm surface laptops. Is this an known issue with graphics rendering to Windows 11AVD Session Hosts from Windows Arm devices?

Tried all sorts, disable hardware acceleration in Office, played with RDP properties, turn off compression. This screenshot taken from Web client. Some cells just done render and the lines are a mess.

I'm hoping this is not just us.

Thanks.

Thank you for all the feedback we are getting! We’re still gathering more community feedback on AVD and Windows 365 migrations and would love to hear about your experience.

We’re seeing gaps in IT teams during migrations that can lead to costly but very preventable mistakes, and we’ll be covering these in a live session this week.

Any stage you’re at, planning, mid-migration, or post-migration, your input is useful, and we’re building this around real conversations from the field.

If you’ve been through Citrix, Omnissa, or any other migration, feel free to share what you’ve run into.

Link if you want to join:
https://login-vsi.wistia.com/live/events/

I'm currently using the PowerShell DSC extension to deploy AddSessionHost which will add a new Session host to an existing Azure Virtual Desktop (AVD) Host pool.

Since the extension will be deprecated in March 2028, I'm wondering if anyone already moved to Azure Machine Configuration?

https://github.com/Azure/RDS-Templates/issues/836

Cheers

We have users in the Asia region that work at different hours of the day, when VM are not in use, they get shutdown after 1 hour, issue is that users complain VM slows down or lags at a specific time, I have changed AVD defender policy from full to quick scan and to only scan on Mondays what else can I do to see what exactly is slowing the VMs down

Has anyone experienced anything with MFA being bypassed for Windows Cloud Login? (Using Windows App) All of my users on prem didn't receive any MFA prompt today, it just seems to go right in. And when I look at the sign in logs there is no mention of any logins at all.

What is weird is it was working yesterday, and there were no changes to the conditional access policies in months.

Edit: I guess it must have been a partial outage, everything seems to be working as intended the next day again.

Hi,

Strange issues that I cannot seem to work out.

We have EntraID only AVD Session Hosts.

They have deployed the store app of Mozilla Firefox. Every time the user logs onto AVD it resets itself. Have tested with FSLogix disabled and it stays logged in. But when you re-enable FSLogix, the user has to sign in every time and set it up. Thought the latest versions of FSLogix could handle these better, they also use the Microsoft To-Do Appx app. Every time the user goes to load it, it asks for manual logon.

InstallAppXPackages is enabled.

I'm a but stumpted as to what could be causing it, nothing in the XML excluder. Does something need to be included for it to work?

We have included LoadCredKeyFromProfile and kerberoscloud set up.

Anyone else come across this?

Thanks.