Configuring and Operating Microsoft Azure Virtual Desktop — knowledge map

The 37 core concepts of Configuring and Operating Microsoft Azure Virtual Desktop and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.

Concepts (37)

• Windows 365 (Cloud PC)

  Streams a cloud PC (desktop) to any device so you get the same environment anywhere.

• Session host

  A Windows VM in Azure Virtual Desktop that delivers desktops/apps to users. It joins a host pool via a registration token and connects to clients through reverse connect (outbound 443).

  Related: Registration token、Reverse connect transport、Host pool (pooled/personal)

• FSLogix

  A mechanism that stores user profiles as VHD/VHDX containers on shared storage and mounts them at logon, preserving settings/data even when signing in to a different VM each time (as in pooled). Includes Profile Container, ODFC, Cloud Cache, and application masking.

  Prerequisites: Host pool (pooled/personal)

  Related: Application masking (app masking)、FSLogix Cloud Cache、ODFC (Office Container)、FSLogix Profile Container

• Host pool (pooled/personal)

  In Azure Virtual Desktop, a collection of identically configured session hosts (VMs). Pooled is shared by multiple users (multi-session, cost-efficient); personal dedicates one host per user and preserves state.

  Prerequisites: Windows 365 (Cloud PC)

  Related: Session host

• Azure NetApp Files

  A managed NFS/SMB file storage offering high performance, low latency, and large scale. In Azure Virtual Desktop it is chosen for high-IOPS needs such as FSLogix profiles in large environments; for small–mid, cost-conscious scenarios choose Azure Files Premium.

  Prerequisites: FSLogix、Azure Files (File storage)、Windows 365 (Cloud PC)

• Autoscaling (scaling plan)

  An Azure Virtual Desktop feature that auto-starts/stops session hosts by time of day (ramp-up/peak/ramp-down/off-peak) or load via a scaling plan, optimizing capacity and cost. Distinct from Start VM on Connect (power on one host at connect).

  Prerequisites: Session host、Windows 365 (Cloud PC)

  Related: Start VM on Connect

• Azure Compute Gallery

  A service (formerly Shared Image Gallery) that versions custom images and replicates them to multiple regions for large-scale distribution to many VMs/subscriptions. In Azure Virtual Desktop it manages and scales out session-host image versions.

  Prerequisites: Session host、Windows 365 (Cloud PC)

• Confidential VM

  A VM that hardware-encrypts in-use memory (data in process) for the highest isolation, protecting sensitive workloads on Azure Virtual Desktop session hosts. It is a different protection layer from Trusted Launch (secure boot + vTPM), which strengthens boot integrity.

  Prerequisites: Session host、Trusted launch、Windows 365 (Cloud PC)

• Microsoft Entra Domain Services

  A managed domain service that provides domain join, Group Policy, and legacy authentication without managing your own domain controllers. In Azure Virtual Desktop it is one session-host identity scenario, sitting between self-managed AD DS and cloud-native Entra ID join.

  Prerequisites: Microsoft Entra ID、Session host、Windows 365 (Cloud PC)

• RDP Shortpath

  An Azure Virtual Desktop feature that establishes a direct UDP path between client and session host instead of the reverse-connect TCP relay, lowering latency and jitter. It has managed-network and public-network variants. Different in purpose from Private Link (private connectivity).

  Prerequisites: Reverse connect transport、Session host、Azure Private Link / Private Link Service、Windows 365 (Cloud PC)

• Reverse connect transport

  The default Azure Virtual Desktop connection method that connects to clients using only outbound 443, with no inbound ports on session hosts—reducing attack surface by not exposing inbound RDP (3389).

  Prerequisites: Windows 365 (Cloud PC)

  Related: Session host

• Start VM on Connect

  An Azure Virtual Desktop feature that powers on a stopped session host only when a user connects, cutting idle cost. It differs from autoscaling (which scales the whole fleet by demand); its purpose is on-demand power-on at first connect.

  Prerequisites: Session host、Windows 365 (Cloud PC)

  Related: Autoscaling (scaling plan)

• Conditional Access

  Grants or challenges access based on conditions like location, device, or risk (a Zero Trust implementation).

• Microsoft Entra ID

  Cloud identity/access management (formerly Azure AD) providing MFA/SSO/Conditional Access; distinct from on-prem AD DS.

  Prerequisites: Conditional Access

• App attach

  An Azure Virtual Desktop app-delivery method (the evolution of MSIX app attach) that packages apps onto storage and mounts them dynamically at logon, letting you update/add apps without rebuilding the image, controlled via user/group assignment.

  Prerequisites: Windows 365 (Cloud PC)

• Application group

  The publishing unit in Azure Virtual Desktop. Two types—desktop app group (full desktop) and RemoteApp group (individual apps)—are published by assigning users/groups and surfaced together via a workspace.

  Prerequisites: Windows 365 (Cloud PC)

  Related: RemoteApp

• Application masking (app masking)

  An FSLogix feature that shows or hides apps per user/group on the same image, giving different audiences different app visibility from one golden image (also useful for license control). Distinct from App attach (dynamic app delivery).

  Prerequisites: App attach

  Related: FSLogix

• AVD Insights

  An operational dashboard (a workbook on Azure Monitor) that visualizes Azure Virtual Desktop connection performance, host utilization, and user connection failures. It requires sending data to Log Analytics and differs in role from general Azure Monitor.

  Prerequisites: Azure Monitor、Windows 365 (Cloud PC)

• FSLogix Cloud Cache

  An FSLogix feature that redundantly stores profile containers across multiple storage providers (regions/accounts), providing high availability that continues if one fails. It is not a substitute for backup (point-in-time restore).

  Prerequisites: FSLogix Profile Container

  Related: FSLogix

• Drain mode

  A state that stops accepting new sessions and evicts existing users before swapping session hosts for updates/maintenance. Pooled updates follow the cycle: publish a new image version → drain → recreate session hosts.

  Prerequisites: Host pool (pooled/personal)、Session host

• ODFC (Office Container)

  An FSLogix feature that separates only Office/Outlook data (OST, search index, Teams cache) into its own container. Used with Profile Container (which roams the whole profile) to speed up the Office experience.

  Related: FSLogix Profile Container、FSLogix

• RemoteApp

  An Azure Virtual Desktop application-group type that publishes individual apps as seamless windows rather than a full desktop. Distinct from a desktop app group, which publishes the full desktop.

  Prerequisites: Windows 365 (Cloud PC)

  Related: Application group

• Universal Print

  A Microsoft cloud print platform that prints directly from session hosts via the cloud without an on-prem print server, meeting Azure Virtual Desktop printing requirements serverlessly.

  Prerequisites: Session host、Windows 365 (Cloud PC)

• Microsoft Defender for Cloud

  Scores security posture (Secure Score) and detects misconfigurations/threats to recommend fixes.

  Prerequisites: Microsoft Defender XDR

• Azure Monitor

  The monitoring foundation collecting metrics and logs; feeds Log Analytics (KQL), Application Insights (app monitoring), and alerts.

• FSLogix Profile Container

  The baseline FSLogix feature that roams the entire user profile in a single container. Distinct from ODFC (Office Container), which separates only Office/Outlook data.

  Related: ODFC (Office Container)、FSLogix

• Shared computer activation (SCA)

  A setting required to correctly activate Microsoft 365 Apps on multi-session session hosts where many users share one VM. Without it enabled, activation fails.

  Prerequisites: Session host、Microsoft 365

• Teams media optimization (WebRTC Redirector)

  A mechanism that improves Microsoft Teams audio/video quality in Azure Virtual Desktop by processing media on the local side, configured via the Remote Desktop WebRTC Redirector Service. Installing Teams alone does not optimize it.

  Prerequisites: Windows 365 (Cloud PC)

• Azure Files (File storage)

  SMB/NFS file shares mountable from multiple machines simultaneously.

• Microsoft Defender XDR

  Unifies protection across endpoints/email/identity/SaaS, correlating signals across domains (Endpoint/Office 365/Identity/Cloud Apps).

• Microsoft 365

  A SaaS productivity suite delivering email, documents, and meetings in the cloud, used via per-user subscription.

• Host pool load balancing (breadth-first / depth-first)

  How a pooled host pool assigns new sessions. Breadth-first spreads across all hosts for an even experience; depth-first fills one host to its limit before the next, reducing VM count and cost.

  Prerequisites: Host pool (pooled/personal)

• Registration token

  A token that lets a session host (VM) join a host pool; the AVD agent registers with it. It expires, and an expired token blocks the session host from joining.

  Prerequisites: Host pool (pooled/personal)

  Related: Session host

• Azure VM Image Builder

  A service that declaratively defines an image build in a template and auto-runs customization steps to build session-host images reproducibly—more consistent than manual Sysprep-based creation. Built images are distributed via Azure Compute Gallery.

  Prerequisites: Azure Compute Gallery、Session host

• Azure Private Link / Private Link Service

  A platform that brings connectivity to PaaS or your own service onto a private IP inside the VNet. Private Link connects to PaaS (Storage/SQL) via a private endpoint (a NIC with a private IP) without the public path. The PaaS public FQDN CNAMEs to a privatelink zone, and the private DNS zone’s A record resolves it to the private IP (forgetting to link → resolves to public IP, a common mistake). Each sub-resource (blob/file, etc.) needs its own endpoint and zone. On-prem resolution uses a DNS Private Resolver plus conditional forwarders. Private Link Service offers your own service (behind a Standard Load Balancer) to other tenants/VNets via Private Link. Unlike service endpoints, it assigns a real private IP and is reachable from on-prem.

• Microsoft Intune

  A cloud service to manage/secure devices and apps; MDM manages the device itself, MAM manages in-app data; integrates with Conditional Access.

  Prerequisites: Conditional Access

• Trusted launch

  Boot-level VM protection providing secure boot (only signed bootloaders run), virtual TPM (vTPM), and integrity monitoring against rootkits and boot-level malware. Configured as the VM security type—a separate layer from at-rest disk encryption.