Azure Virtual Desktop: Manage Azure Virtual Desktop host pools and session hosts using the Azure portal [Part 02]

This guide is designed within the context of managing and optimizing Azure Virtual Desktop (AVD) environments, with a particular focus on the use of Microsoft Entra ID–joined session hosts (formerly Azure AD). In constantly evolving business scenarios, it is often necessary to adapt virtual infrastructure to support growth, improve user experience, and ensure security, availability, and cost control. Please see Azure Virtual Desktop – Deploy host pools and session hosts in the Azure portal with (Microsoft Entra ID) – Part 01.

The main objective is to provide an operational path for configuring and managing an existing AVD host pool, leveraging the capabilities offered by integration with Microsoft Entra.

This approach simplifies identity management, enables Single Sign-On (SSO), and enhances user access to virtual resources while reducing overall infrastructure complexity. Through the activities described, the guide will address key aspects such as:

• scaling capacity by adding new session hosts,
• optimizing host pool configurations,
• managing permissions through Role-Based Access Control (RBAC),
• automating maintenance with scheduled agent updates,
• customizing RDP connection properties to improve the user experience.

This guide is intended for IT professionals, system administrators, and cloud engineers who want to strengthen their skills in managing modern AVD environments by adopting best practices for scalable, secure, and efficient deployments.

At the end of this exercise, you will be able to effectively manage an Azure Virtual Desktop infrastructure integrated with Microsoft Entra, meeting key operational and business requirements.

Also, see Azure Virtual Desktop – Set Up Azure Virtual Desktop Insights Monitoring – Part 03, Azure Virtual Desktop – Connect to Session Hosts Using Entra ID – Part 04, and Disaster Recovery Test Checklist: What to Capture Before You Start

Deploy Additional Session Hosts to an Azure Virtual Desktop Host Pool

Sign in to the Azure portal, open Azure Virtual Desktop, navigate to Host pools, and select the previously created host pool to deploy additional session hosts.

Verify that the host pool contains two session hosts by opening Session hosts under Manage.

On the your Host Pool | Session hosts page, select + Add.

In the Basics tab of the “Add virtual machines to a host pool” page, review the settings and go to Virtual Machines.

On the Virtual Machines tab of the “Add virtual machines to a host pool” page, set Availability options to No infrastructure redundancy required (as per lab guidance), keep the other settings as default, and click Review + create.

Note: Additionally, it is important to note that although the VM image and name prefix can be changed when adding session hosts to an existing pool, this practice is generally not recommended unless all VMs in the pool are intended to be replaced, to maintain consistency and avoid configuration drift.

Note: On the Review + create tab, select Create and proceed to the next task without waiting for provisioning, which may take about 20 minutes.

Review and Configure Host Pool Properties

Open Host Pool Properties

Summary: On the xxxxx-hp1 page, in the Settings section, select Properties.

On the xxxxx-hp1 Properties page, review key host pool settings including the preferred app group type (Desktop or RemoteApp), the option to start VMs on connect, the validation environment setting for testing updates before production, and the load balancing algorithm (breadth-first or depth-first session distribution).

On the XXXXX-hp1 Properties page, set the Load balancing algorithm to Depth-first and configure the Max session limit to 8.

On the XXXXX-hp1 Properties page, enable Start VM on Connect by setting it to Yes.

Note: This feature helps reduce costs by powering on session host VMs only when needed. In personal host pools, it starts only VMs already assigned (or assignable) to a user, while in pooled host pools, additional VMs are started only when existing ones reach the session limit and more capacity is required.

On the XXXXX-hp1 Properties page, click Save to apply the changes.

Note: Using Start VM on Connect requires assigning the Desktop Virtualization Power On Contributor RBAC role to the Azure Virtual Desktop service principal at the subscription scope.

Retrieve Azure Subscription ID for RBAC Configuration of Azure Virtual Desktop Service Principal

If prompted in the Getting started pane, select the Azure subscription used for this lab from the Subscription drop-down list, then click Apply.

Please see Upgrading Azure AD Connect to Microsoft Entra Connect Sync, PCI Driver Error: Connection to Deployment Share could not be made, and Steps to Fix the “Invalid OS GUID” Error in MDT.

PowerShell Command (Cloud Shell)

In the PowerShell session within Azure Cloud Shell, run the following command to retrieve the current Azure subscription ID and store it in the $subId variable:

$subId = (Get-AzSubscription).Id

•	$parameters = @{
    RoleDefinitionName = "Desktop Virtualization Power On Contributor"
    ApplicationId = "9**************************************7"
    Scope = "/subscriptions/$subId"
}

Run the following command in the Azure Cloud Shell PowerShell session to create the RBAC role assignment:

New-AzRoleAssignment @parameters

Close cloud Powershell

• Configure Scheduled Updates for Azure Virtual Desktop Agents

The Scheduled Agent Updates feature allows configuration of up to two maintenance windows for updating the Azure Virtual Desktop agent, side-by-side stack, and Geneva Monitoring agent, ensuring updates occur outside business hours.

In the Azure portal, navigate to the XXXXX-hp1 host pool. From the left-hand menu under Settings, select Scheduled agent updates, then enable the feature by selecting the corresponding checkbox. Configure the schedule to use the local session host time zone. In the Maintenance window section, set the update window to Saturday at 11:00 PM (23:00), and then apply the configuration.

Configure RDP Properties of the Host Pool

In the Azure portal, open the az140-21-hp1 host pool page and, from the left-hand menu under Settings, select RDP Properties. On the Connection information tab, review the available configuration options:

• Microsoft Entra single sign-on: Enables Microsoft Entra authentication for Microsoft Entra-joined session hosts, providing a single sign-on experience. The client device does not need to be Microsoft Entra-joined.
• Credential Security Support Provider (CredSSP): Controls secure credential delegation from the client device to the session host; it does not support Microsoft Entra ID authentication.
• Alternate shell: Specifies an executable to start automatically when a session begins (applicable only to Windows Server session hosts).
• KDC proxy name: Enables Kerberos authentication traffic to be proxied to Active Directory domain controllers.

Since three of these options are not applicable in this scenario (Microsoft Entra-joined session hosts without Active Directory Domain Services), only Microsoft Entra single sign-on is configured. This corresponds to the RDP property enablerdsaadauth:i:value

Select “Connections will use Microsoft Entra authentication to provide single sign-on” in the Microsoft Entra single sign-on dropdown and save the configuration.

IMPORTANT: Enabling this RDP property is only one step in implementing single sign-on. A complete configuration also requires enabling Microsoft Entra authentication for RDP in the tenant and configuring device groups, which are not available in this guide.

For the full set of required steps, refer to the official documentation on Microsoft Entra ID single sign-on for Azure Virtual Desktop: Configure single sign-on for Azure Virtual Desktop using Microsoft Entra ID authentication

On the XXXXX-hp1 RDP Properties page, review the Session behavior settings, including reconnection, bandwidth and network auto-detection, compression, and video playback options.

Set Reconnection to Client automatically tries to reconnect and save the configuration.

On the XXXX -hp1 RDP Properties page, open the Device redirection tab and review the available options, which include Audio and video and Local devices and resources.

By default, all disk drives are redirected, including those mounted after the session starts.

On the XXXX-hp1 RDP Properties page, open the Display settings tab and review options such as support for multiple displays, smart sizing, and configurable desktop resolution (in pixels).

On the XXXXX-hp1 RDP Properties page, open the Advanced tab and review the current configuration settings, which reflect the changes applied earlier in this task.

This completes the second part of the Azure Virtual Desktop guide. Proceed to third part for the next steps as referenced above.

I hope you found this article on “Manage Azure Virtual Desktop host pools and session hosts using the Azure portal [Part 02]” very useful. Please feel free to leave a comment below.