How the best teams optimise Azure Virtual Desktop with Nerdio Manager
Optimisation in Azure Virtual Desktop (AVD) is not achieved through a single setting or feature. The most successful environments are run by admins who apply consistent operational habits, leverage automation, and regularly review data-driven insights.
After working with many production AVD environments, a clear pattern emerges. The most efficient, stable, and cost-effective deployments all share the same behaviours.
Below are 7 habits of highly effective Nerdio admins and how they use Nerdio Manager for Enterprise to optimise without sacrificing performance or user experience.
1. Standardise and automate desktop image management
Highly effective admins never build images manually in Azure.
Instead, they:
Create and manage desktop images directly in Nerdio
Automate sysprep, sealing, and versioning
Maintain clean, repeatable image pipelines
This approach:
Eliminates configuration drift
Reduces troubleshooting time
Enables predictable re-imaging and scaling
Lowers operational overhead
A well-maintained image is the foundation of every efficient AVD environment.
2. Automate Windows patching (and stop firefighting)
Manual patching is expensive — not just in Azure costs, but in engineer time and risk.
Effective admins:
Automate Windows Updates on desktop images
Patch personal host pools directly where appropriate
Schedule updates x days after Patch Tuesday
Combine patching with automated image updates and host re-imaging
The result:
Consistent security posture
Reduced downtime
Fewer emergency maintenance windows
Predictable change control
Automation here directly translates to lower operational cost and reduced risk.
7. Optimise Log Analytics instead of accepting default costs
Monitoring is essential — but unmanaged telemetry can quietly inflate Azure bills.
Highly effective admins:
Review Log Analytics data collection
Adjust polling intervals and counters
Reduce retention where appropriate
Balance visibility with cost
By tuning Log Analytics properly, teams maintain observability while avoiding unnecessary ingestion and storage costs.
Final thoughts
Optimisation in AVD is not about cutting corners — it is about operating deliberately.
Admins who adopt these seven habits:
Spend less on Azure
Reduce operational toil
Improve stability and security
Scale with confidence
If you are already using Nerdio Manager, these capabilities are available today. The difference is not tooling — it is how consistently the tooling is used.
This is the starting point. I’ll be sharing detailed deep dives into each habit soon, focusing on practical configuration and optimisation tips.
If you’ve been waiting to run Azure Virtual Desktop (AVD) + FSLogix without Windows AD domain controllers or Microsoft Entra Domain Services, Microsoft has now introduced a public preview capability that makes it possible: Microsoft Entra Kerberos authentication for Azure Files SMB with cloud-only identities.
This unlocks a true cloud-native pattern where:
Users are sourced from Microsoft Entra ID (cloud-only)
Session hosts are Entra-joined
FSLogix profile containers are stored on Azure Files
No DCs / no AAD DS required
Microsoft announced this preview in late 2025 as part of the broader “cloud-native identity” push for Azure Files.
For cloud-only identities in this preview, default share-level permissions are the supported approach (applies to all authenticated users accessing shares in the account).
Entra Kerberos does not support MFA for Azure Files SMB access. If MFA is enforced, you may see errors such as System error 1327 / sign-in restrictions.
Everyone’s Conditional Access policies will be different; you’ll need to ensure any policies enforcing MFA for all resources and applied to AVD users have an exclusion for the storage account.
What to do:
Go to Conditional Access
Identify policies that target all resources
Add an exclusion for the Storage Account “app” (search it by name [Storage Account xxx.file.core.windows.net])
Save
This is a common “why can’t I map the drive” failure mode during testing.
Step 5 — Configure FSLogix Profile and Session Hosts to Retrieve Kerberos Tickets
If you skip this, you may get:
Credential prompts when mapping the share
System error 86
You must add a registry key to each Entra-joined session host that will access the share. Nerdio can configure this registry value and the FSLogix settings as part of the FSLogix Profiles Storage Configuration.
Nerdio Manager → Profiles Management → New profile → FSLogix
Enter the profile name
Select Configure session hosts registry for Entra ID joined storage
Enter the FSLogix Profiles path (VHDLocation), the UNC path of your storage account, share, and directory (\\<storageaccount>.file.core.net\<share>\<directory>]
Important caveat: This setting can prevent on-premises AD-joined clients from accessing storage accounts via the legacy flow; if you need both Entra and Windows AD access patterns, realm mapping may be required (scenario-specific).
Step 6 — Configure Directory and File-Level Permissions for FSLogix (Critical)
Even if FSLogix “works” without this, you risk a serious security issue:
Users may be able to access other users’ profile containers
6A) Validate you can mount the share (from an Entra-joined session host)
Log on to a session host as a member of your “Storage Admin” Entra group, then run from Command Prompt:
net use X: \\<storageaccount>.file.core.windows.net\<share>
If it fails:
Verify Step 5 registry key is present
Reboot the session host (often required during early preview workflows)
6B) Set ACLs using Azure Portal “Manage access” (not File Explorer / icacls)
In cloud-only identity mode, Microsoft provides an Azure Portal ACL experience for Windows-style permissions on Azure Files SMB.
If you’ve ever planned a Nerdio Manager for Enterprise (NME) deployment, you may be aware that there isn’t just one way to install it. Depending on how your Azure environment is structured — identities, tenants, permissions, governance, and AVD architecture — the installation path can look very different.
This is one of the questions I’m asked most often by customers:
“Which installation method do I actually need to use?”
To make this easier, I created a simple decision tree (I’ll include a diagram at the end) and broke down each installation type. Whether you’re deploying for a single small environment or a global multi-tenant estate, this guide should point you in the right direction.
Why are there multiple installation methods?
Nerdio Manager integrates deeply with:
Entra ID
Azure subscriptions
Azure Virtual Networking
AVD / Windows 365 resources
App registrations
Service principals
Resource providers
Because every customer structures their identity and resource topology differently, NME provides installation paths for a range of real-world scenarios — including restricted RBAC environments and split-tenant setups.
Summary of All Installation Types
Here is a high-level overview of all six installation methods available in Nerdio Manager.
1️⃣ Standard Install (Azure Marketplace)
The most common and simplest deployment method.
Use this when:
Your user identities and AVD resources live in the same Entra ID tenant.
You have the required permissions to deploy and initialise NME.
You don’t need to customise the Entra ID application name.
Typical customers: Most AVD/W365 deployments, POCs, and standard single-tenant setups.
Some organisations do not allow deployment engineers to create app registrations — typically due to strict RBAC, identity governance, or Conditional Access rules.
Use this when:
You don’t have permission to create an Entra ID app.
A separate team (Identity/Security) needs to pre-create the Nerdio app for you.
You’ll reference the existing App ID, Secret, and Object ID during initialization.
Some customers have user identities mastered in another tenant but synchronised into the AVD tenant as guest / external identities. This is not split identity — everything still runs in a single AVD tenant.
Use this when:
Your users are guests from another tenant.
You want them to connect to AVD/Windows 365 using External Identities.
You want to avoid maintaining a full split-tenant architecture.
Putting It All Together — The Installation Decision Tree
I created a simple flowchart to help customers quickly identify the correct installation type. It includes:
Tenant topology
Permissions
Identity architecture
Guest user model
Multi-tenant requirements
NME deployment decision tree
Final Thoughts
Choosing the right installation method is crucial for:
Proper AVD lifecycle management
Compliance with your organisation’s identity model
Ensuring NME has the permissions it needs
Avoiding rework later
Supporting multi-tenant or cross-tenant architectures
If you’re planning a new deployment or reviewing your existing setup, this guide (and the diagram) should help you pick the correct path with confidence.
