Plan and implement identity and security
Two identity decisions, made early
Session host identity: AD DS joined (needs line of sight to a domain controller), Entra joined (no domain controller, Intune-managed, fully supported by AVD), or hybrid Entra joined. Choose before deployment; changing later means redeploying hosts.
User identity: Entra ID with Conditional Access and MFA. CA policies target the Azure Virtual Desktop cloud app and can require MFA, a compliant or hybrid-joined device, or a sign-in frequency. Watch for policies that block personal devices or break single sign-on.
RBAC with least privilege
Use roles scoped to the resource, not the subscription: Desktop Virtualization Contributor, Host Pool Contributor, Application Group Contributor, Workspace Contributor, and Desktop Virtualization User for end users. Users get access by being assigned to an application group and holding the user role on that group - not by owning the subscription.
Protecting the profile store
FSLogix on Azure Files needs an identity: AD DS Kerberos for domain-joined hosts, Entra Kerberos for Entra-joined hosts. On top of share-level RBAC (Storage File Data SMB Share Contributor) you need NTFS permissions, including Creator Owner full control on the parent folder. Private endpoints keep SMB traffic off the public internet but require matching DNS.
Traps
Entra-joined hosts cannot authenticate to an AD DS-only file share with user credentials; missing Creator Owner permissions produce "access denied" on logon; and a "require compliant device" CA policy silently locks out unmanaged endpoints.
Worked example: Entra join + Intune + Entra Kerberos for Azure Files, one CA policy requiring MFA and a compliant device for the AVD app, with a documented break-glass exclusion.